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VOLUME  IV 
IN  THE  UNITED  STATES  ARMY 

UNITED  STATES 
VS. 

MANNING,   Bradley  E.,   PFC  COURT-MARTIAL 
U.S.  Army,  xxx-xx-9504 

Headquarters  and  Headquarters  Company, 

U.S.  Army  Garrison, 

Joint  Base  Myer-Henderson  Hall, 

Fort  Myer,  VA  22211 

 / 

The  Hearing  in  the  above-entitled  matter  was 
held  on  Monday,   June  10,   2013,   at  9:30  a.m.,  at 
Fort  Meade,  Maryland,  before  the  Honorable  Colonel 
Denise  Lind,   Judge . 
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DISCLAIMER 

This  transcript  was  made  by  a  court 
reporter  who  is  not  the  official  Government  reporter, 
was  not  permitted  to  be  in  the  actual  courtroom  where 
the  proceedings  took  place,  but  in  a  media  room 
listening  to  and  watching  live  audio/video  feed,  not 
permitted  to  make  an  audio  backup  recording  for 
editing  purposes,   and  not  having  the  ability  to 
control  the  proceedings  in  order  to  produce  an 
accurate  verbatim  transcript . 

This  unedited,   uncertified  draft 
transcript  may  contain  court  reporting  outlines  that 
are  not  translated,  notes  made  by  the  reporter  for 
editing  purposes,  misspelled  terms  and  names,  word 
combinations  that  do  not  make  sense,   and  missing 
testimony  or  colloquy  due  to  being  inaudible  to  the 
reporter . 
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PROCEEDINGS, 

THE  COURT:     Court  is  called  to  order.     Mr.  Fein, 
please  account  for  the  parties . 

MR.  FEIN:     Your  Honor,   all  parties  present  when  the 
court  last  recessed  are  again  present  with  the  following 
exceptions:     Mr.  Robert  Shaw,   court  reporter's  absence;  Mr. 
Chavez,   court  reporter  who  is  present  previously;  Captain 
Overgaard  is  absent,   and  Captain  Morrow  and  Captain  Whyte  are 
present . 

THE  COURT :     All  right .     Thank  you . 

Let ' s  begin  with  any  housekeeping .     Have  we  had 
anything  marked  as  an  appellate  exhibit,  as  a  defense  exhibit 
or  a  prosecution  exhibit? 

MR.  FEIN:     Yes,  ma'am.     A  moment. 

Your  Honor,   first  the  parties  agreed  to  a 
stipulation  of  expected  testimony  from  Mr.   Steven  Buchanan, 
dated  9  June  2013  and  this  has  been  marked  as  prosecution 
exhibit  69  for  identification. 

THE  COURT:     All  right.     PFC  Manning,   do  you  have  a 
copy  of  prosecution  exhibit  69? 

THE  ACCUSED:     Yes,   Your  Honor. 
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THE  COURT:     And  we  have  had  this  discussion  on  other 
stipulations  of  expected  testimony  and  will  have  this 
discussion  probably  several  times  again  I  believe  in  the 
course  of  this  court-martial,   but  with  this  particular 
stipulation  of  a  Mr.   Steven  Buchanan  dated  9  June  2013,  it 
consists  of  four  pages .     Is  that  your  signature  on  the  last 
page? 

THE  ACCUSED:     Yes,  ma'am. 

THE  COURT :     Before  signing  this  stipulation  did  you 
read  it  thoroughly. 

THE  ACCUSED:     I  did,   Your  Honor. 

THE  COURT:     Do  you  agree  with  the  contents  of  the 
stipulation? 

THE  ACCUSED:     Yes,  ma'am. 

THE  COURT:     Before  signing  this  stipulation,  did 
your  defense  counsel  explain  the  stipulation  to  you? 
THE  ACCUSED:     Yes,  ma'am. 

THE  COURT:     Do  you  have  any  questions  about  the 
stipulation? 

THE  ACCUSED:     No,   Your  Honor. 

THE  COURT:     Do  you  understand  that  you  have  an 
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absolute  right  to  refuse  to  stipulate  to  the  contents  of  this 
document? 

THE  ACCUSED:     I  do,   Your  Honor. 

THE  COURT :     Do  you  understand  you  should  enter  into 
this  stipulation  only  if  you  believe  it ' s  in  your  best 
interest  to  do  that? 

THE  ACCUSED:     Yes,   Your  Honor. 

THE  COURT:     And  once  again,   I  want  you  to  understand 
how  this  stipulation  is  going  to  be  used.     It's  a  stipulation 
of  expected  testimony,   and  what  that  means  is  when  counsel 
for  both  sides  and  you  agree  to  a  stipulation  of  expected 
testimony,   you  are  agreeing  that  if  Mr.   Steven  Buchanan  were 
here  in  court  sitting  on  the  witness  stand  and  under  oath 
that  Mr .  Buchanan  would  testify  substantially  as  to  what  is 
in  this  stipulation  of  expected  testimony? 

THE  ACCUSED:     Yes,   Your  Honor. 

THE  COURT :     And  his  testimony  can  be  contradicted, 
attacked  or  explained  the  same  way  as  if  he  was  testifying 
here  live  in  court,   and  you're  not  admitting  to  the  truth  of 
the  person ' s  testimony? 

THE  ACCUSED:     Yes,  ma'am. 
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THE  COURT:     And  knowing  what  I  told  you  and  what 
your  defense  counsel  earlier  told  you  about  this  stipulation, 
do  you  still  want  to  enter  into  this  stipulation  of  expected 
testimony? 

THE  ACCUSED:     Yes,  ma'am. 

THE  COURT:     Counsel  for  both  sides  agree  to  the 
stipulation  and  its  content? 

MR.  FEIN:     Yes,  ma'am. 
MR.  HURLEY:     Yes,  ma'am. 

THE  COURT:     Prosecution  exhibit  69  is  admitted. 

MR.  FEIN:     Your  Honor,   also  on  5  June  2013  what  has 
been  marked  as  appellate  exhibit  564,  United  States  filed  its 
witness  list  order  and  proposed  stipulations  for  the 
prosecution  witnesses  for  the  remainder  of  the  government's 
case  in  chief. 

THE  COURT :     All  right .     As  I  understand  it ,  the 
parties  are  still  working  on  some  of  those  stipulations? 

MR.  FEIN:     Yes,  ma'am.     Although  there  are  many 
stipulations  that  are  annotated  by  both  parties  on  this 
filing,  we  are  working  and  probably  the  next  recess  we'll 
have  many  more  of  these  signed  and  ready  for  the  court  to  go 
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over  with  the  accused. 

MR.   COOMBS:     Ma'am,   as  part  of  the  802  session  we 
discussed  if  the  government  were  to  add  anyone  on  to  this 
list  they  would  give  the  defense  a  24  hour  notice. 

MR.  FEIN:     Yes,  ma'am.     And  the  United  States 
acknowledges  that . 

THE  COURT :     All  right .     Any  other  housekeeping 

matters? 

MR.  FEIN:     Yes,  ma'am. 

Ma'am,   as  of  this  morning  the  media  operations 
center  consists  of  11  journalists  and  two  stenographers .  The 
theater  is  not  currently  being  used.     And  the  overflow 
trailer  is  also  not  currently  being  used  although  available 
and  up  to  30  seats . 

THE  COURT:     All  right.     And  once  again,   for  the 
record,   up  to  this  point  in  time  of  the  trial  have  any 
members  of  the  public  been  specifically  excluded  based  on  the 
court ' s  order? 

MR.  FEIN:     No,  ma'am. 

THE  COURT :     All  right .     Thank  you .     Does  defense 
have  any  reason  to  disagree? 
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MR .   COOMBS :     No ,   Your  Honor . 

THE  COURT:     Any  other  matters  for  housekeeping? 

MR.  FEIN:     No,  ma'am. 

MR.   COOMBS:     No,   Your  Honor. 

THE  COURT :     All  right .     The  government  proposed 
trial  schedule  plan,   I  announced  at  the  beginning  of  the 
trial  that  we  would  try  it  out  for  a  week  and  see  how  it 
worked.     We  had  a  little  fluctuation  last  week  because  we 
recessed  early,  but  that's  at  appellate  exhibit  551.  There 
was  no  defense  objection.     The  court  will  approve  that 
proposed  trial  plan,   it  certainly  may  be  modified  as  we  go 
along  depending  on  necessity,  but  for  now  it  provides  a  good 
rough  schedule  on  how  we  will  proceed,  usually  starting  0930 
in  the  morning,   ending  approximately  at  5:30  or  six  o'clock 
at  night  depending  on  the  status  of  the  particular  witness 
who  is  on  the  stand. 

Any  issues  with  appellate  exhibit  551? 

MR .   COOMBS :     No ,   Your  Honor . 

MR.  FEIN:     No,  ma'am. 

THE  COURT :     All  right .     Next  we  have  appellate 
exhibit  563  and,   for  the  record,   counsel  and  I  entered  into  a 
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RCM  802  conference  this  morning.     Once  again,   that's  a 
conference  where  I  discuss  scheduling  and  logistics  that 
arise  in  cases .     One  of  the  issues  that  came  up  was  any 
change  that  came  up  to  the  government's  witness  list  that  Mr. 
Coombs  has  already  mentioned. 

Another  was  appellate  exhibit  563  which  is  the 
request  from  the  Freedom  of  the  Press  Foundation  that  was 
addressed  to  myself  and  Major  General  Linnington  who  is  the 
commander  of  the  United  States  Military  District  of 
Washington  with  respect  to  credentialing  two  stenographers 
to,  an  overlap  of  two  stenographers  to  report,  to  create  an 
unofficial  transcript  of  this  trial  which  they  intend  to 
broadcast  that  will  be  available  to  all  media  outlets  and  the 
public  is  what  this  letter  tells  me .     Mr .  Coombs  advised  me 
that  the  defense  would  like  to  comment . 

MR.   COOMBS:     Yes,   Your  Honor.     Just  briefly. 

We  believe  that  this  enforces  PFC  Manning's  Sixth 
Amendment  right  to  a  public  trial  and  also  impacts  on  a  First 
Amendment  right  for  the  press  to  accurately  keep  track  of 
what  happens  in  the  court-martial .     Our  understanding  is  that 
the  government  now  is  assuring  that  the  stenographers  will 
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have  access  during  non-peak  times,   and  then  during  peak  times 
they  are  looking  into  whether  they'll  have  access  at  the  MOC 
or  not.     It  appears  that  regardless  of  whether  it's  peak  or 
non-peak  they're  going  to  be  given  an  access  pass  instead  of 
credential  passes. 

And  then  I  know  that  we  still  have  an  outstanding 
issue  on  whether  or  not  the  government  can  accommodate  the 
requests  to  have  one  of  the  stenographers  come  in  at  0700  and 
another  come  in  during  the  afternoon  session  to  where  we 
don ' t  have  a  requirement  for  both  of  the  stenographers  to  be 
present  the  entire  day. 

THE  COURT:     All  right.     Major  Fein,  would  you  like 
to  be  heard? 

MR.  FEIN:     Ma'am,   the  United  States  after  the  RCM 
802  and  based  off  of  questions  defense  has  asked  owes  the 
court  and  defense  some  answers  to  questions .     One  is  can  the 
overflow  trailer  be  used  as  an  area  for  a  stenographer  versus 
the  media  operations  center  and,   second,  the  logistics  of 
actually  having  an  individual  escorted  on  or  off  post  and 
we'll  get  both  those  questions  answered  today,  Your  Honor. 

THE  COURT :     All  right .     Thank  you . 
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Just  for  the  record,   while  the  court  is  not 
interested  in  getting  into  the  area  of  who  is  credentialed 
and  who  isn't  credentialed  as  it's  beyond  the  scope  of  this 
trial,  the  court  does  note  and  so  advised  the  parties  in  the 
RCM  802  that  rules  of  court-martial  are  not  structured  to 
provide  a  contemporaneous  transcript  of  proceedings .  In 
light  of  the  public  interest  in  this  case,   in  light  of  the 
unique  circumstances  of  this  case,   in  light  of  the  assertion 
by  PFC  Manning  that  this  stenographer  procedure  will  further 
his  rights  to  a  Sixth  Amendment  right  to  a  public  trial  and 
also  obviously  further  the  public ' s  First  Amendment  right  to 
a  public  trial,  the  court  has  ordered  the  government  to 
arrive  at  some  kind  of  accommodation  to  allow  stenography  of 
the  proceedings  of  this  trial  and  the  creation  of,   I  guess 
what  their  intent  is  an  unofficial  transcript,   certainly  not 
an  official  transcript,   the  government's  not  doing  it.  So 
the  government's  in  the  process  of  making  that  arise.  And 
just  for  the  record,  this  rule  or  this  guidance  of  the  court 
can  always  be  reconsidered  should  there  be  a  violation  of  the 
rules  of  court  with  respect  to  audio  broadcasting  or  visual 
broadcasting  once  these  procedures  are  put  into  place . 
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Does  either  side  desire  to  address  this  issue  any 

further? 

MR.  FEIN:     No,   Your  Honor. 
MR .   COOMBS :     No ,  ma ' am . 

Ma'am,  before  we  go  on,   could  we  please  correct  one 
exhibit  for  the  record? 

THE  COURT:  Certainly. 

MR.  FEIN:     Earlier  the  court  when  discussing  the 
government ' s  proposed  trial  schedule  plan  referenced 
appellate  exhibit  551.     The  actual  proposed  trial  schedule 
plan  is  553  Alpha. 

THE  COURT:     All  right.     Does  the  defense  agree? 

MR.   COOMBS:     I'll  have  to  take  Major  Fein's  word  for 
it,  ma'am,   I  don't  have  the  appellate  exhibits  in  front  of 
me . 

THE  COURT:     All  right.     553  Alpha  and  that's  the 
government's  proposed  trial  schedule  dated  21  May  2013,  is 
that  correct? 

MR.  FEIN:     Yes,   Your  Honor. 

THE  COURT :     Okay .     That ' s  the  court ' s  mistake . 
The  court  is  prepared  to  rule  on  the  request  for 
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public  access  or  in  the  alternative  motion  to  intervene  to 
vindicate  right  to  public  access.     On  3  June  2013  the  court 
received  appellate  exhibit  558  of  a  proposed  motion  to 
intervene  under  rules  for  court-martial,   806A,   B  and  C  by 
three  individuals  who  are  not  parties  to  the  trial .  Neither 
the  government  nor  the  defense  have  moved  to  file  appellate 
exhibit  558  as  a  motion  with  the  court . 

Findings .     One .     The  proceedings  have  been  open  to 
the  public  since  the  start  of  the  trial .     The  court  has  made 
particularized  findings  as  required  by  806B  with  respect  to 
those  portions  of  the  trial  that  must  be  closed  to  protect, 
appellate  exhibit  550. 

Two.     Neither  the  court  nor  anyone  acting  pursuant 
to  order  of  the  court  has  specifically  excluded  any  person 
from  observing  the  proceedings  either  in  court  or  in  a 
designated  overflow  area. 

Three .     Reasonable  policies  and  procedures  for  media 
registration  and  credentialing  have  been  established  and 
published  by  the  Military  District  of  Washington  as  set  forth 
in  appellate  exhibit  561. 

Four.     806C  prohibits  photography  and  broadcasting 
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to  include  audio  and  video  recording. 

Five .     The  two  parties  to  this  trial  are  the  United 
States  and  PFC  Manning.     Unless  authorized  by  the  rules  for 
court-martial,   or  in  special  circumstances  recognized  by  the 
Court  of  Appeals  for  the  Armed  Forces,   only  parties  to  the 
trial  have  standing  to  file  motions  to  be  considered  by  this 
court.     ABC  Inc.  versus  Powell,   Court  of  Appeals  for  the 
Armed  Forces,  1997. 

Ruling.     The  court  declines  to  consider  appellate 
exhibit  558  as  it  is  from  three  individuals  who  are  not 
parties  to  the  trial  and  who  under  the  circumstances  lack 
standing  to  file  a  motion  with  the  court . 

I ' 11  have  this  marked  as  the  next  appellate  exhibit 

in  line . 

Is  there  anything  else  we  need  to  address  at  this 
point  before  going  forward  with  the  merits  of  the  trial? 

MR .   COOMBS :     No ,   Your  Honor . 

MR.  FEIN:     No,   Your  Honor. 

THE  COURT:     Government,  proceed. 

MR.  FEIN:     Ma'am,   the  United  States  offers  Mr. 
Buchanan's  stipulation  to  be  read  into  the  record. 
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THE  COURT:  Proceed. 

MR.  FEIN:     Stipulation  of  expected  testimony  of  Mr. 
Steven  Buchanan,    9  June  2013. 

It  is  hereby  agreed  by  the  accused,  defense  counsel 
and  trial  counsel  that  if  Mr .   Steven  Buchanan  were  present  to 
testify  during  the  merits  and  presentencing  phases  of  this 
court-martial  he  would  testify  substantially  as  follows : 

I  work  as  a  contractor  for  the  National  Security 
Agency,  NSA.     I  provide  support  to  Intelink .     Intelink  is  a 
software  suite  operating  on  U.S.   government  private  networks 
which  provides  Internet-like  services  to  enable  collaboration 
between  intelligence  agencies  within  the  United  States 
government . 

Primarily  it  includes  a  web-based  search  engine  of 
unclassified,   secret  and  top  secret  information  systems .  It 
hosts  blogs  and  allows  for  messaging,   sharing  files  and 
searching  for  unclassified,   secret  and  top  secret  information 
across  agencies,  to  include  Intellipedia  for  online 
collaboration  and  passport  account  management . 

In  my  current  position  I  provide  security  for 
Intelink  and  serve  as  the  assurance  IA  manager.     This  means  I 
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make  sure  the  systems  work  as  intended.     I  work  to  make  sure 
the  systems  are  properly  maintained  and  guard  against  their 
misuse .     I  have  worked  in  this  role  for  five  years . 

Prior  to  holding  my  current  position  from  1999  to 
2008  I  was  an  information  systems  security  engineer  for 
Intelink.     In  this  position  I  made  sure  the  systems  are  built 
correctly  to  perform  their  intended  connection,   search  and 
storage  functions .     Before  that  I  worked  in  systems  support 
within  the  intelligent  community,   IC.     In  total  I  have  worked 
in  the  IA  industry  supporting  different  industries  in  the  IC 
since  1985. 

I  have  two  primary  IA  and  information  systems 
certifications  —  excuse  me  —  certifications.     First,   I  am  a 
certified  information  systems  security  professional,  CISSP. 
This  means  I've  heightened  experience  in  the  knowledge  of 
information  security.     CISSP  is  a  globally  recognized 
standard  of  achievement  that  confirms  an  individual ' s 
knowledge  in  the  field  of  information  security.  This 
training  covers  all  parts  of  information  security  including 
personnel  and  building  securities  aspects. 

CISSP  indicates  that  an  individual  has  attained 
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specialized  knowledge  in  the  field  of  IA  in  accordance  with 
standards  articulated  and  in  Department  of  Defense  Direct 
Live . 

In  addition  to  CISSP  I  also  have  the  information 
technology  infrastructure  library,   ITIL,  foundation 
certification .     ITIL  is  the  most  widely  adopted  framework  for 
IT  service  management  in  the  world.     ITIL  provides  a 
framework  on  technology  systems  management,  particularly  on 
how  to  build  information  management  systems  and  manage  them 
with  a  specific  process . 

In  my  role  as  an  IA  manager  for  Intelink,   I  am 
familiar  with  the  audit  logs  created  by  Intelink .  The 
Intelink  maintains  mansion  and  stores  audit  data  through  the 
course  of  its  day  to  day  operations .     This  data  be  can  be 
used  to  respond  to  and  monitor  and  maintain  Intelink  usage 
and  performance .     These  logs  are  created  anytime  anyone  makes 
a  connection  with  a  computer  system. 

The  system  detects  these  connections  with  SERS, 
tracking  the  work  station  making  the  request  of  the  system, 
how  requests  route  through  the  system,   and  where  the  request 
ultimately  gets  the  information.     These  connection  logs  are 
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made  in  real-time  and  stored  in  data  files  every  hour .  They 
are  computer  generated  and  only  a  very  limited  number  of 
people  have  access  to  them. 

Intelink  logs  contain  audit  data  captured  from  proxy 
servers  that  control  access  to  Intelink  servers  and  shows  the 
work  of  users  in  systems  that  connect  to  and  use  the  Intelink 
services  while  in  a  classified  and  unclassified  network. 

We  know  that  Intelink  logs  are  accurate  for  several 
reasons:     First,  they  write  to  a  secure  server;   second,  only 
limited  personnel  have  access  to  them;  third,  they  are 
reviewed  by  our  team  at  least  on  a  weekly  basis  to  insure 
that  the  reporting  processes  are  occurring  properly,  meaning 
to  insure  that  the  log  data  is  being  written  properly. 

The  log  data  is  useful  to  us  because  it  shows  us  how 
our  services  are  being  used,   whether  Intelink  services  are 
running  properly  and  whether  adjustments  should  be  made. 

We  can  also  use  the  data  to  solve  technical  issues, 
determine  security  risks  and  review  data  trends  that  help  us 
develop  our  management  strategies . 

We  can  tell  if  there  are  errors  because  information 
the  logs  normally  collect  would  be  missing.     If  a  data  file 


Provided  by  Freedom  of  the  Press  Foundation 


1 

2 
3 
4 
5 
6 
7 
8 
9 
10 
11 
12 
13 
14 
15 
16 
17 
18 
19 
20 
21 


UNOFFICIAL  DRAFT  -  6/10/13  Morning  Session 


21 

has  been  corrupted  while  being  written,   it  would  not  open. 
Missing  or  corrupt  —  missing  or  corrupt  data  files  are 
regenerated  from  the  system,   so  in  short  the  data  these 
systems  logs  have  captured  is  complete  and  accurate. 

I  am  involved  in  this  case  because  we  received  a 
request  to  pull  Intelink  audit  logs  given  Intelink  could  have 
been  used  to  gather  information  that  was  ultimately 
compromised . 

At  that  time  we  did  not  track  users  by  log-in 
identifiers .     Instead,  we  tracked  usage  by  IP  address .  One 
of  the  log  data  requests  was  from  the  secret  or  —  excuse  me, 
ma'am  —     secure  Internet  protocol  routing  network,  SIPRNET, 
IP  address  22  dot  225  dot  41  dot  22  and  22  dot  225  dot  41  dot 
40  from  October  2009  to  June  2010. 

Intelink  audit  logs  are  stored  on  a  Linux  based 
system.     To  pull  the  requested  log  I  performed  a  Linux  search 
on  the  server .     This  means  that  I  issued  a  line  command 
telling  the  server  what  information  I  wanted  to  read.  When 
the  system  returns  the  data,  the  system  writes  the  data  to  a 
file. 

In  reviewing  the  files  returned  I  could  find  no 
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relevant  information  in  the  data  files  for  October  2009  or 
June  2010.     However,  there  was  activity  recorded  for  the 
relevant  IP  addresses  for  the  months  November  2009  through 
and  including  May  2010. 

I  double-checked  to  make  sure  there  was  no  activity 
from  the  relevant  IP  addresses  during  October  of  2009,  and 
then  ran  the  search  again  to  verify  the  results . 

The  results  of  the  second  search  match  the  results 
of  my  original  search.     The  results  are  saved  automatically 
as  a  dot  TXT  file  so  they  are  readable  to  the  person  running 
the  query.     When  I  received  the  response  to  my  IP  data  query, 
I  opened  the  file  to  make  sure  it  was  readable  and  that  all 
the  data  had  been  reported  properly.     I  did  not  alter  the 
file  in  any  way. 

I  burned  the  file  to  a  CD  and  then  turned  it  over  to 
Special  Agent  Mark  Mander  with  Army  CID .     These  logs  are  on 
the  CDs  marked  prosecution  exhibit  61  for  identification. 
The  file  names  on  Intelink  logs  I  have  attested  to  showing 
activity  for  IP  addresses  22  dot  225  dot  41  dot  22  are  the 
following:     J  F  10  underscore  22  dot  log,  M  A  N  10  underscore 
22  dot  text,   and  M  D  09  underscore  22  dot  log. 
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The  file  names  of  the  Interlink  logs  that  I  attested 
to  showing  activity  for  IP  address  22  dot  225  dot  41  dot  40 
are  the  following:     J  F  10  underscore  40  dot  log,  M  A  N  10 
underscore  40  dot  TXT,   N  V  09  underscore  40  dot  log. 

The  file  J  F  10  underscore  22  dot  log  contains  audit 
logs  capturing  data  for  the  22  dot  225  dot  41  dot  22  IP 
address  in  January  and  February  2010. 

The  file  M  A  N  10  underscore  22  dot  text  contains 
audit  logs  capturing  activity  for  the  22  dot  225  dot  41  dot 
22  IP  address  in  March,  April  and  May  2010. 

The  file  N  K  09  underscore  22  dot  log  contains  audit 
logs  capturing  activity  for  the  22  dot  225  dot  41  dot  22  IP 
address  in  November  and  December  2009. 

I  used  the  same  file  name  structure  to  capture  the 
contents  of  the  audit  logs  associated  with  the  22  dot  225  dot 
41  dot  40  IP  address. 

The  particular  log  data  I  captured  reported  several 
things .  I  will  use  the  following  discrete  line  data  to  show 
by  way  of  example  to  show  what  the  Intelink  logs  mean . 

Excuse  me,   Your  Honor. 

22  dot  225  dot  41  dot  40.     29  slash  November  slash 
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2009  colon  05  colon  10  colon  plus  000,   end  bracket,  quotation 
D  E  T  slash  Intelink  dot  W  I  P  dot  I  S  M  C  dot  S  gov  dot  gov 
slash  web  resource  dot  A  X  D  question  mark  D  equals  A  Z  7  K  D 
R  R  C  Q  C  L  TV  13  Z  G  P  21  N  Q  2  and  T  equals 

6336277576757031205  space  HTTP  slash  1.1,   end  quote,  space 
200  space  6665,   quotation  mark,   HTTP  colon  slash  slash  W  W 
W  dot  Intelink  dot  S  gov  dot  gov  slash  A  S  P  X  question  mark 
Q  equals  H  D  Q  A,   end  quote,   space,   quote,  mozilla  slash  5.0 
percent  20,  open  parentheses,  Windows  semicolon  —  excuse  me, 
Your  Honor  —  percent,   20  U  semicolon  percent  20  Windows 
percent  20  NT  percent  20  dot  1  semicolon  percent  20  E  N  dash 
U  S  semicolon  percent  twenty  R  V  colon  1.9.1.2,  end 
parentheses,  percent  20  gecko  slash  20090729  percent  20 
Firefox  slash  3.5.2,   end  quote,   space,   quote,   dash,  quote. 

Excuse  me,   Your  Honor.     Hyphen,   not  dash. 

Paragraph  eight .     The  significance  of  the  above  line 
that  was  pulled  from  Intelink  is  the  following:     The  22  dot 
225  dot  41  dot  40  is  the  IP  address.     This  indicates  that  a 
computer  with  the  IP  address  made  the  request  for 
information.     Essentially  it  provides  an  electronic  location 
for  the  user  using  Intelink. 
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The  29  slash  November  slash  2009  colon  04  colon  10 
colon  50  ten  plus  0000  is  a  date  time  group.     The  time  zone 
is  reflected  as  the  offset  from  the  Greenwich  Mean  Time,  GMT. 
In  this  case  plus  0000  shows  no  offset . 

The  next  entry  is  the  action  the  user  took .     In  this 
case,   for  example,  you  see,  you  see  quote,   get,   end  quote. 
This  commands  indicates  the  user  is  seeking  particular 
information  on  SIPRNET  through  Intelink .     The  action  reflects 
the  user  checking  on  something  in  the  website . 

The  next  entry  is  the  page  being  requested  by  the 
action  above.     Here  it  is,   quote,   slash  Intelink  W  W  I  P  dot 
S  I  M  C  dot  gov  dash  A  X  D  question  mark  D  equals  A  Z  7  K  D  C 
CCLTV13ZGP21NQ2  and  T  equals  63362776  —  excuse 
me.     Your  Honor,   I'll  repeat  this  number  — 
633627756757031250  space  HTTP  slash  1.1,   end  quote. 
Intelink  W  I  P  dot  M  I  S  C  dot  gov  is  the  registered  name  for 
Intelink  which  is  on  the  SIPRNET,   a  secret  government  system. 

The  code  of  numbers  for  all  —  excuse  me  —  for  the 
information  tells  you  whether  the  user ' s  request  was 
successful  and  to  what  degree.     For  example,  the  code,  quote, 
200,   end  quote,   after  particular  information  indicates  that 
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an  Internet  home  page,  HTTP,  was  successfully  accessed. 
The  quote,    6665,   end  quote,   is  the  size  in  bytes  of  the 
information  returned  by  the  query.     The  entry  HTTP  colon 
slash  WWW  slash  search  default  S  S  A  S  P  X  Q  equals  tells 
me  the  user  searched  for  the  term,   quote,   H  D  Q  A  on 
Intelink . 

In  this  entry,   quote,   search,   end  quote,   is  a 
specific  Intelink  service  used  and,   quote,   Q  equals  H  D  Q  A, 
end  quote,   represents  the  search  query  entered  into  the 
search  box  on  the  Intelink  web  page  on  the  specific  computer 
with  the  IP  address  listed  above. 

The  entry,   quote,  mozilla  slash  5.0,   end  quote, 
tells  me  the  user  of  the  SIPRNET  computer  with  an  IT  address 
of  dot  40  was  using  verse  five  of  the  mozilla  Internet 
browser .     Mozilla  is  a  company  that  produced  Internet  browser 
software  similar  to  Microsoft  Explorer.     The  entry  20 
indicates  a  space  in  the  line.     The  entry,   quote,  Windows 
semicolon  percent  20  U  semicolon  percent  20  windows  percent 
20  N  T  percent  205.1  semicolon  percent  20  E  N-U  S  semicolon 
20  R  V  colon  1.9.1.6  close  parenthesis,   end  quote,   tells  me 
the  user  of  the  SIPRNET  computer  with  an  IP  address  of  22  dot 
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225  dot  41  dot  40  was  using  a  Windows  NT  work  station 
computer . 

The  entry,   quote,   percent  20  gecko  slash  20090729 
percent  20  Firefox  3  slash  5.2,   end  quote,   tells  me  that  the 
user  of  the  SIPRNET  computer  with  an  IP  address  of  dot  40  was 
using  a  version  of  the  Firefox  Internet  browser  version 
number  3.5.2.     Firefox  is  a  specific  name  of  the  Internet  web 
browser  program  produced  by  the  mozilla  company. 

These  Intelink  logs  only  audit  what  happens  on  the 
Intelink  system,   so  it  can  only  tell  you  what  a  particular 
user  IP  address  was  doing  when  connected  with  the  Intelink 
system.     It  would  reveal  Intellipedia  searches  and  other  ways 
the  user's  IP  address  used  Intelink  searches  by  showing  what 
files  within  Intelink  that  IP  address  accessed. 

At  the  time  users  were  not  required  to  have  Intelink 
passport  accounts  to  use  most  Intelink  services,  including 
the  SIPRNET  Internet  search  and  browsing.     A  SIPRNET  Intelink 
passport  account  is  a  user  name  and  password  account 
established  to  allow  access  to  some  government  websites .  It 
is  one  of  the  many  applications  Intelink  uses  on  its  own 
internal  systems  to  track  what  a  user  accesses .     A  user  would 
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need  an  account  if  he  wanted  to  contribute  to  Intelink 
services  or  access  certain  websites  or  databases  on  SIPRNET, 
but  not  just  to  conduct  searches . 

To  create  an  account  a  user  would  have  to  be  on  the 
SIPRNET,   go  to  the  account  creation  page  and  insert  personal 
information  such  as  name,   contact  and  organizational 
information .     The  user  is  then  notified  via  SIPRNET  email 
with  a  code  to  use  the  first  time  he  accesses  the  site. 
Other  government  organizations  or  websites  and  databases  on 
SIPRNET  use  SIPRNET  Intelink  passport  accounts  before  any 
user  may  access  their  information  on  SIPRNET. 

Our  Intelink  organization  maintains  and  stores 
Intelink  account  passport  profiles  and  registered  Intelink 
users .     In  a  response  to  a  request  by  Army  CID  I  looked 
Bradley  Manning  up  in  our  system.     Someone  with  the  name, 
quote,  Manning,   comma,   Bradley,   space,   E,   end  quote,   did  have 
an  account.     The  user  name  of  the  individual  was,  quote, 
Bradley  dot  E  dot  Manning  end  quote .     According  to  the  user 
account,   Bradley  dot  E  dot  Manning,   his  pay  rate  was  E  4  and 
used  an  email  address  of  Bradley  dot  Manning  at  U.S.   dot  Army 
dot  mil .     The  user  name  is  automatically  generated  based  on  a 
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common  name  used  by  the  individual  setting  up  the  account . 
The  user  information  identifies  each  identifying  factor  such 
as  name,   contact  information  security  questions  and  answers 
the  user  inputs  into  the  system  at  the  time  of  the  account 
creation . 

According  to  the  passport  account,   the  last  time  the 
user  logged  in  was  27  April  2010  at  1805  and  46  seconds  Zulu 
time.     According  to  the  passport  account  the  registration 
date  was  11  October  2008 .     The  password  account  information 
is  marked  as  P  C  62  for  identification .     I  signed  an 
attestation  on  22  June  2012,   Bates  number  00505257,  attesting 
to  the  authenticity  of  what  have  been  marked  as  PE  61  and  PE 
62  for  identification  and  are  the  provided  logs  in  the 
Intelink  password  account  information  for  Bradley  dot  E  dot 
Manning  contained  in  the  file  Manning  dot  LDIV. 

Your  Honor,   the  United  States  moves  to  admit 
prosecution  exhibits  61  and  62  for  identification  as 
prosecution  exhibits  61  and  62 . 

MR.  HURLEY:     No  objection,  ma'am. 

THE  COURT:     All  right.     Is  prosecution  exhibit  61  a 

CD? 
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MR.  FEIN:     Your  Honor,   two  CDs,   CD  one  of  two  and 
two  of  two .     And  62  is  a  printout . 

Your  Honor,  may  I  have  a  quick  moment? 
THE  COURT:  Yes. 

All  right .     Prosecution  exhibits  61  and  62  are 

admitted. 

Handing  it  back  to  the  court  reporter.  Government, 
are  you  ready  to  proceed? 

MR.  FEIN:     Yes,  ma'am. 

MR.  MORROW:     Your  Honor,   the  United  States  recalls 
Special  Agent  David  Shaver. 
Whereupon : 

DAVID  SHAVER, 

called  as  a  witness,  having  been  previously  duly  sworn 
according  to  law,  testified  as  follows : 

DIRECT  EXAMINATION 

BY  MR.  MORROW: 

Q.       Special  Agent  Shaver,   you  are  still  under  oath. 
A.       Yes,  sir. 

Q.       Agent  Shaver,   I  want  to  begin  by  talking  about  some 
SIPRNET  Intelink  logs  collected  as  part  of  this  case,  but 
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first  I  need  to  ask  a  few  preliminary  questions . 

Did  you  examine  any  SIPRNET  computers  associated 
with  PFC  Manning  as  part  of  this  investigation? 
A.       Yes,   sir,   I  did. 

Q.       And  what  were  the  IP  addresses  of  those  computers? 

A.       They  were  ending  in  dot  22  and  dot  40. 

Q.       And  again  for  the  record,   what  is  an  IP  address? 

A.       That's  like  a  telephone  number  for  a  computer. 

Q.       And  are  you  familiar  with  Intelink? 

A.       Yes,   sir,   I  am. 

Q.       And  what  is  Intelink? 

A.       It's  Google  of  the  SIPRNET. 

Q.       And  did  you  examine  any  logs  collected  from  the 
SIPRNET  Intelink  site  in  this  case? 
A.       Yes,   sir,   I  did. 

Q.       And  what  did  those  logs  contain  generally? 

A.       They  generally  contained  the  source  IP,  the  computer 
making  the  request,   date  and  time  of  the  request  and  some  of 
the  search  list . 

Q.       Now,   were  the  Intelink  logs  you  examined  all  of 
Intelink  or  just  associated  with  a  particular  IP? 
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A.       They  were  just  associated  with  dot  22  and  dot  40. 
Q.       And  what  time  period  roughly  did  the  logs  cover? 
A.       November  2009  to  May  2010. 

Q.  And  why  was  that  time  period  collected  as  part  of 
this  case? 

A.       Sir,   that's  when  PFC  Manning  was  in  theater. 

Q.       When  you  received  the  log  files,  what  do  you  do;  do 
you  work  off  that  copy  or  do  you  work  off  another  copy? 

A.       Sir,   for  ease  of  review  for  this  case  I  took  them 
and  converted  them  to  an  Excel  spreadsheet  for  ease  of 
review . 

Q.       Okay.     So  let's  just  back  up  a  little  bit  though. 
In  what  form  did  you  receive  the  log  files? 
A.       They  were  text  files. 
Q.       And  what  is  a  text  file? 

A.       Sir,   it's  just,    just  raw  text,  unformatted. 

Q.  And  so  what  did  you  do  once  you  found  or  at  least 
opened  the  files  and  they  were  text  files,  what  did  you  do 
next? 

A.       I  imported  them  into  Excel. 

Q.       And  generally  why  do  log  files  come  to  you  in  text, 
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is  that  standard? 

A.       Yes,   sir,  generally. 
Q.       And  why  is  that? 

A.       Sir,    just  for  ease  of  transferring  information 
between  one  —  for  review  and  ease  of  transferring  the  data 
from  one  computer  to  another .     Text  is  a  common  format  for 
that. 

Q.       And  when  you  received  the  log  files  and  text,   if  you 
had  printed  those  text  files  —  first  let  me  ask  this 
question.     Was  it  one  big  file  or  several  small  file  files? 

A.       There  are  several  smaller  files. 

Q.       If  you  had  printed  just  one  of  those  files, 
approximately  how  many  pages  would  that  have  come  out  to? 

A.       Quite  a  lot.     Maybe  a  hundred  or  so,   if  not  more. 

Q.       And  that's  just  for  one  log  file? 

A.       Yes,  sir. 

Q.       Now,  you  said  you  converted  these  text  files  into 
Excel? 

A.       Yes,  sir. 

Q.       And  once  they  were  converted,   if  you  had  printed 
that  entire  log  sheet  essentially  or  all  the  logs  for  the 
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time  period,  how  many  pages  are  we  talking  about? 

A.       A  lot.     Several  hundred,   if  not  more. 

Q.       And  in  your  line  of  work,   do  you  regularly  transfer 
text  files  from  just  the  raw  data  format  to  Excel? 

A.       Yes,  sir. 

Q.       And  is  that  a  difficult  process? 
A.       No,  sir. 

Q.  And  when  you  transfer  the  information  from  text  to 
the  Excel  spreadsheet,  did  you  alter  the  information  in  any 
way? 

A.       No,  sir. 

Q .       All  right .     So  let ' s  talk  about  the  logs  in  the 
Excel  format .     Once  you  had  them  in  that  format ,  what  did  you 
do  next? 

A.       I  wanted  to  determine  since  this  is  Google 
basically,   I  wanted  to  determine  what  keywords  were  used, 
what  was,  what  keywords  were  entered  and  what  was  searched. 

Q.       And  how  do  you  determine  based  on  looking  at  the 
logs  what  searches  were  made  from  these  computers? 

A.       What  I  did  is  I  went  to  Intelink  on  my  SIPRNET 
computer  and  I  did  some  keyword  searches  and  then  I  requested 
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my  Intelink  logs  from  my  SIPRNET  computer. 

Q.       Now,   when  you  say  you  requested  your  Intelink  logs, 
did  you  have  to  go  somewhere  else  to  ask  for  — 

A.       I  had  to  put  a  request  in. 

THE  COURT :     Just  a  moment .     Yes . 

MR.   TOOMAN:     Your  Honor,   if  the  government  would 
like  to  introduce  the  logs  that  Agent  Shaver  made,  the 
defense  will  stipulate  to  that . 

THE  COURT:     You  are  laying  a  foundation? 
MR.  MORROW:     I  need  to  explain  to  the  court 
essentially  what  they  are. 

THE  COURT:     That's  fine.     Go  ahead. 
BY  MR.  MORROW: 

Q.       So,   again,   the  process  of  finding  a  search? 
A.       Yes,   sir.     So  I  found  the  keywords  that  I  searched 
for  and  then  I  went  to  the  logs  and  determined  there ' s  a 
specific  pattern  that  predates  before  the  search,   so  once  I 
figured  out  what  the  pattern  is,  the  keyword  followed  it  and 
I  filtered  it  off  of  that. 

Q.       So  you  used  the  pattern  to  then  filter  off  the  logs 
that  you  had  already  collected? 
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A.  Correct. 

Q.       And  once  you  had  that  pattern  identified  into  the 
raw  logs  essentially,  what  did  you  do  next? 

A.  I  extracted  all  the  keywords  out  as  a  separate  tab 
on  the  Excel  spreadsheet  and  then  I  started  looking  at  what 
keywords  were  entered. 

Q.       I  am  retrieving  prosecution  exhibit  81  for 
identification  from  the  court  reporter . 

Agent  Shaver,   if  I  could  have  you  move  to  the  panel 
box,  please. 

A.       Yes,  sir. 

MR.  MORROW:     Your  Honor,   this  exhibit  already  been 
shown  to  defense . 

THE  COURT :     All  right .     Thank  you .     I  notice  Captain 
Tooman  nodding  his  head. 

MR.   TOOMAN:     Yes,  ma'am. 
BY  MR.  MORROW: 

Q.       I  am  handing  the  witness  what  has  been  marked  as 
prosecution  exhibit  81  for  identification. 

Agent  Shaver,   if  you  could  just  take  a  moment  and 
look  that  you  that ,  please . 
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Agent  Shaver,   do  you  recognize  that  document? 
A.       Yes,   sir,   I  do. 
Q.       And  what  is  it? 

A.       Sir,  this  is  the  keywords,  the  spreadsheet  that  I 
created  that  contains  the  keywords . 

Q.       When  you  say  keywords,  again,  what  does  that  mean? 
What  kind  of  activity  is  that  capturing  from  the  Intelink 
logs? 

A.       Sir,   if  you  went  to  the  Intelink,   it's  a  website, 
you  would  put  a  keyword  in,   cat,  dog,   it  would  log  that,  the 
word  cat,   and  that's  what  I  did  was  I  pulled  out  those 
individual  searches.     So  you,   again,  this  is  go  to  the 
website,  you  put  in  a  keyword  and  hit  enter. 

Q.       And,  Agent  Shaver,   did  you  create  that  document? 

A.       Yes,  sir. 

Q.       And,   again,   is  that  an  accurate  summary  of  all  of 
the  Intelink  searches  on  the  SIPRNET  from  these  two  user 
accounts? 

A.       Yes,   sir.     The  two  computers,  sir. 
Q.       Dot  22  and  dot  40? 
A.       Yes,  sir. 
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Q.       And  when  you  extracted  the  searches  from  the  full 
logs,   did  you  alter  the  information  in  any  way? 

A.       I  extracted  out  the  information,  but  I  did  not  alter 
them. 

MR.  MORROW:     Your  Honor,   at  this  time  the 
prosecution  moves  to  admit  prosecution  exhibit  81  for 
identification  into  evidence . 

MR.   TOOMAN:     No  objection,   Your  Honor. 

THE  COURT:     Can  I  see  it,  please? 

Prosecution  exhibit  81  for  identification  is 

admitted. 

MR.  MORROW:     I'm  going  to  hand  the  exhibit  back  to 
the  witness  to  ask  a  few  questions . 
BY  MR.  MORROW: 

Q.       Agent  Shaver,   can  you  generally  just  describe  the 
information  and  the  columns  just,   you  know,   the  headers 
essentially  left  to  right. 

A.       Sure.     Yes,   sir.     The  first  field  would  be  a  number 
field,  that ' s  something  I  put  in  there  to  make  it  easier  so 
you  can  reference  the  number . 

The  next  field  is  IP  address . 
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The  next  field  is  the  date  and  time . 
The  next  field  is  the  time  zone . 
And  the  action,  the  keyword  that  was  entered. 
Q.       Now,   when  you  say  date,   I'm  sorry,   when  you  say  date 
and  time,  what  do  you  mean  by  that,  the  date  and  time  some 
word  was  searched? 
A.  Yes. 

Q.       And  when  was  the  first  search  by  either  one  of  those 
computers? 

A.  It  would  be  10  November  2009. 
Q.  And  when  was  the  last  search? 
A.       7  May  2010. 

Q.       And  I  want  to  talk  about  —  actually,   first,   let  me 
just  ask  this  question.     When  was  the  first  search  for 
WikiLeaks  in  that  summer? 

A.       1  December  2009. 

Q.       And  are  there  any  other  searches  based  on  your 
review  of  those  searches  that  you  thought  were  of  interest  to 
the  investigation  that  were  odd  in  any  way? 

A.       Yes,   sir.     There  were  several  that  were  odd, 
searches  for  things  like  Iceland  and  Julian  Assange,  they 


Provided  by  Freedom  of  the  Press  Foundation 


1 

2 
3 
4 
5 
6 
7 
8 
9 
10 
11 
12 
13 
14 
15 
16 
17 
18 
19 
20 
21 


UNOFFICIAL  DRAFT  -  6/10/13  Morning  Session 


40 

seemed  out  of  place . 

Q.       And  why  do  you  say  that? 

A.       Sir,   it  is  my  understanding  these  computers  were  at 
FOB  Hammer  Iraq  and  should  have  been  focused  on  events  in  and 
around  FOB  Hammer  Iraq. 

Q.       Thank  you.     I'm  retrieving  prosecution  exhibit  81. 
Agent  Shaver,   you  can  move  back  to  the  witness  box. 
Thank  you. 

Agent  Shaver,   I  want  to  talk  about  some  of  the 
searches  for  WikiLeaks  and  where  they  led  on  the  SIPRNET . 
What  happens  when  the  user  at  one  of  the  IP  addresses 
searches  through  what  comes  back  in  the  log? 

A.       There  would  be  some  search  hits.     If  the  user  then 
clicks  on  log  files  or  clicks  on  a  link,   it  will  show  that 
link  that  has  been  clicked  and  things  of  that  nature . 

Q.       Now,   in  this  case  at  least  for  these  SIPRNET  logs, 
does  the  activity  after  the  search,   is  that  always  captured? 

A.       No,  sir. 

Q.       And  why  would  sometimes  there  be  gaps,  sir? 
A.       If  the  user  went  to  a  web  page,  entered  Intelink, 
entered  a  search  term  and  it  was  directed  to  a  new  web  page, 
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in  essence  they're  now  on  that  web  server,  no  longer  part  of 
the  Intelink  world. 

Q.       Okay.     I'm  retrieving  what's  been  marked  as 
prosecution  exhibit  45  for  identification. 
THE  COURT:     Captain  Tooman? 

MR.   TOOMAN:     I'm  just  standing  up  to  look,  Your 

Honor . 

BY  MR.  MORROW: 

Q.       I'm  handing  the  witness  what  has  been  marked  as 
prosecution  exhibit  45  for  identification. 

Agent  Shaver,   just  take  a  look  at  that,  please. 
Do  you  recognize  that  document? 
A.       Yes,   sir,   I  do. 
Q.       And  what  is  it? 

A.       It's  the  Army  Counter  Intelligence  Center  report  on 
WikiLeaks . 

Q.       And  was  this  document  accessible  via  the  SIPRNET? 
A.       Yes,  sir. 

Q.       And  based  on  your  review  of  the  Intelink  logs,  did 
any  searches  for  WikiLeaks  lead  to  the  discovery  or  the 
access  of  this  document  on  the  SIPRNET? 
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A.       Yes,  sir. 

Q.       And  how  did  you  go  about  identifying  this  particular 
document  in  the  Intelink  logs? 

A.       This  document  was  provided  to  me  for  examination  to 
compare  against  a  document  that  was  released  by  WikiLeaks, 
and  the  original  document  that  was  provided  to  me  a  unique 
name  was  provided. 

Q.       So  it  wasn't  titled  at  least  whatever  the  title  of 
the  document  was? 

A.       No,  sir. 

Q.       Do  you  recall  what  the  title  was? 

A.       It  started  with  R  B  O  8  and  there  were  some  numbers 
after  that . 

Q.       Okay.     I  am  retrieving  prosecution  exhibit  45  for  ID 
from  the  witness  and  I  am  retrieving,   again,  prosecution 
exhibit  84  for  identification  from  the  court  reporter. 

I  am  handing  the  witness  what  has  been  marked  as 
prosecution  exhibit  84  for  identification  to  the  witness. 

Agent  Shaver,   do  you  recognize  that  document? 
A.       Yes,   sir,   I  do. 
Q.       And  what  is  it? 
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A.       This  is  another  document  I  created  based  upon  the 
searches  for  the  R  B  document  from  the  Intelink  logs . 

Q.       So  what  does  that  document  show  essentially? 

A.       It  shows  four  different  times  in  which  the  IP  dot  40 
viewed  or  attempted  to  view  the  R  B  document . 

Q.       Okay.     I'm  retrieving  —  first  can  we  publish  this 
to  the  court,   Your  Honor? 

THE  COURT:  Proceed. 
BY  MR.  MORROW: 

Q.       Agent  Shaver,   I  want  to  start  with  line  one.  Can 
you  just  describe  for  the  court  the  activity,  the  action  on 
the  very  far  right,  please? 

A.       Yes,   sir.     You  see  the  last  —  how  do  you  clear  it? 

Q .       Don ' t  worry  about  that . 

A.       The  line  I've  managed  to  —  there  you  go.  Thank 
you,  sir. 

The  last  line  there  you  see  it  says  H  T  T  P  W  W  W 
Intelink  S  dot  gov  search  default,   Q  equals  WikiLeaks,  that 
was  the  search  query  for  this,   the  search  terms  WikiLeaks  was 
used,   and  these  are  the,  the  result  was  this  document.  And 
if,  again,   if  you  look  at  that  third  from  the  bottom  it  says 
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the  address,   dot  north  dot  Army  not  smil  dot  mil,   a  little 
further  down  you  see  the  document  itself,   R  B  0  8  dot  AST 
P,   and  a  little  further  to  the  right  you  see  where  it  was  200 
and  then  there's  numbers  at  the  end.     200  means  it's 
successful,  this  document  was  viewed. 

Q .       And  what ' s  a  dot  ASP? 

A .       That ' s  like  a  web  page . 

Q.       In  lines  2,   3  and  4,   do  you  see  the,   is  there  also  a 
successful  access  in  those  cases? 

A.       No,   sir.     The  302,   it's  a  redirect,   so  at  this  time 
if  they  clicked  on  that  link  looking  for  that  specific 
document,   it  went  somewhere  else. 

Q.       Okay.     So  you  can't  tell  if  that  was  successful 
access  of  that  document? 

A.       No,  sir. 

Q.       Now,   again,   in  at  least  this  summary,   what,  which 
line  is  the  successful  access  versus  the  — 
A.       It  would  be  the  first  one,  sir. 
Q .       And  what ' s  the  date  of  that  search? 
A.       29  December  2009. 
Q.       Thank  you. 
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THE  COURT:     My  understanding  the  29  December  2009 
was  successful  and  the  other  three  were  not? 

THE  WITNESS:  They  may  have  been,  therein  lies  the 
permutation  of  the  log  files.  If  you  click  on  the  link,  it 
redirected  it  to  somewhere  else  and  I  don't  know  where. 

THE  COURT:     Thank  you. 

THE  WITNESS :     So  it  may  have  been . 

MR.  MORROW:     Your  Honor,   at  this  time  the 
prosecution  moves  to  admit  prosecution  exhibit  84  for 
identification  into  evidence . 

MR.   TOOMAN:     No  objection,   Your  Honor. 

THE  COURT :     All  right .     Prosecution  exhibit  84  is 

admitted. 

BY  MR.  MORROW: 

Q.       Agent  Shaver,   I  want  to  talk  about  the  Intelink 
searches  and  the  14  February  2010  timeframe.     First,   based  on 
your  review  of  the  searches  in  these  logs,   did  the  logs 
capture  any  searches  for  WikiLeaks  on  14  February  2010? 

A.       Yes,   sir,   I  believe  they  did. 

Q.       And  generally  again  where  did  these  searches  lead  on 
the  SIPRNET? 
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A.       To  websites  that  have  information  pertaining  to 
WikiLeaks . 

Q.       I'm  retrieving  what's  been  marked  as  prosecution 
exhibit  85  for  identification . 

Agent  Shaver,   I'm  handing  you  prosecution  exhibit  85 
for  identification . 

A.       Yes,  sir. 

Q .       Just  take  a  moment  and  look  at  it ,  please . 
I'm  retrieving  prosecution  exhibit  85  for 
identification  with  the  witness.     Permission  to  publish,  Your 
Honor . 

THE  COURT:     Go  ahead. 
BY  MR.  MORROW: 

Q.       Agent  Shaver,   I  won't  go  through  all  the  lines  in 
this  document,  but  just  describe  for  the  court  what  this, 
first  of  all,   again,  what  is  the  document? 

A.       Again,   this  is  a  subset  of  the  Intelink  logs  for 
February  14,  2010. 

Q.       And  where  does  this  subset  of  logs  begin,  what's  the 
first  action? 

A.       Again,   it's  another  search  for  WikiLeaks,   you  can 
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see  that  from  the  top  line  under  the  Q  equals  WikiLeaks  in 
this  search,  and  the  search  ended  up  on  an  Army  website. 

Q.       Can  you  just  point  out  the  line,  please?     It  might 
be  easier  if  I  just  hand  it  back  to  you . 

A.       Yes.     I'm  sorry,   it's  a  little  blurry  on  here. 

Q.       Based  on  your  review  of  the  logs,  were  you  able  to 
identify  any  documents  accessed  by  the  user  of  those  IP 
addresses  in  the  logs? 

A.       Yes,  sir. 

Q.       And  what  documents  were  you  able  to  identify  as 
being  accessed? 

A.       There  is  one  called  C  C  C  here  be  dragons  trip 
report . 

Q.       And  what  line  is  that  in  that  summary? 
A.  12. 

Q.       And  were  there  any  other  documents  accessed  as  a 
result  of  this  search  on  Intelink? 

A.       There  is  an  IIR  as  well,   following  a  bunch  of 
numbers,   classified  documents  on  WikiLeaks  dot  PDF. 

Q.       And  based  on  your  review  of  the  Interlink  logs 
generally,  have  you  ever  seen  this  document  accessed  at  a 
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previous  time  other  than  February  14? 
A.       Yes,  sir. 

Q.       And  what  timeframe  was  that? 

A.       I  believe  it  was  early  December. 

Q.       Agent  Shaver,   I  just  want  to,   what  created  this 
document? 

A.       I  did. 

Q.       And  how  did  you  create  it? 

A.       Sir,   it  was  just  filtered  on  the  date  for  February 

14. 

MR.  MORROW:     Your  Honor,   at  this  time  the 
prosecution  moves  to  admit  prosecution  exhibit  85  for 
identification  into  evidence . 

MR.   TOOMAN:     No  objection. 

THE  COURT:     May  I  see  it,  please? 
BY  MR.  MORROW: 

Q.       Agent  Shaver,   I  want  to  shift  gears  for  a  moment. 
Other  than  searches  made  from  the  computers  on  Intelink,  what 
other  activity  was  significant  that  you  observed  in  the 
Intelink  logs? 

A.       There  were  a  number  of  hits,   there  were  a  number  of 
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downloads  using  the  WGet  utility. 
Q.       And  what  is  WGet? 

A.       Sir,   that  is  a  command  line  program  executable 
designed  to  basically  download  files  from  web  pages . 

Q.       And  when  you  say  something's  a  command  line  program, 
what  do  you  mean  by  that? 

A.       It's  command  line,   so  there  is  not  a  graphical  user 
interface .     There ' s  no  need  for  a  mouse .     You  have  to  type 
the  commands  in  from  the  command  prompt .     So  if  you  were  to 
go  to,  you  have  a  Windows  computer,   if  you  go  to  start,  run, 
type  CMD,   and  hit  enter,   a  little  black  window  would  open  and 
that  would  be  command  window.     You  could  then  type  commands 
from  there . 

Q.       Now,   is  WGet  —  what  is  it,   is  it  software? 
A.       Yes,  sir. 

Q.       And  you  also  said  something  about  executable. 
What's  an  executable? 

A.       It's  just  a  program  that  runs. 

Q.       And  what's  the  difference  between  software  and 
executable? 

A.       Same  thing,  sir. 
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Q.       It's  just  exactly  basically? 
A.  Yeah. 

Q.       Now,  based  on  your  knowledge  and  experience,   is  WGet 
a  standard  program  on  Army  computers? 

A.       Not  Windows  computers,   no,  sir. 
Q.       Why  do  you  say  that? 

A.       Sir,   part  of  our  mission  at  CCIU  was  to  find  malware 
on  a  computer,   so  we  had  access  to  the  Army  Gold  Master.  And 
the  Army  Gold  Master  or  AGM  is  how  the  Army  distributes 
software  to  include  Office  and  operating  systems  themselves 
across  the  Army  network.     So  we  had  access  to  that.     We  would 
use  that  to,  once  you  know  what's  supposed  to  be  there,  it's 
easier  to  figure  out  what ' s  not  supposed  to  be  there . 

Q .       All  right .     Let ' s  talk  about  the  presence  of  WGet  in 
the  logs .     Do  you  recall  the  first  example  of  WGet  in  the 
logs? 

A.       I  believe  it  was  March  2010. 

Q.       I  am  retrieving  what's  been  marked  as  prosecution 
exhibit  83  for  identification.     I'm  now  showing  them  to 
defense  counsel. 

I'm  handing  the  witness  what  has  been  marked  as 
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prosecution  exhibit  83  for  identification.     Agent  Shaver, 
could  you  take  a  moment  and  look  through  that,  please? 
A.       Yes,  sir. 

Q.       Do  you  recognize  that  document? 
A.       Yes,   sir,   I  do. 
Q.       And  what  is  it? 

A.       Sir,   this  is,   again,   this  is  a  filtered  on  WGet  from 
March  7  from  the  Intelink  logs . 

Q.       And,   again,  when  you  say  you  filtered,   so  you 
created  that  document? 

A.       Yes,   sir,   I  did. 

Q.       And  when  you  created  the  document,   did  you  a  filter 
the  information  in  any  way  from  the  original  logs? 
A.       No,  sir. 

Q.       So  what  was  the  filter  you  used  to  sort  of  create 
that  summary? 

A.       Basically  WGet  on  March  7. 

Q.       And  what  does  that  document  show,   just  generally, 
and  in  a  moment  we'll  go  through  it,  but  just  generally  what 
does  it  show? 

A.       Sir,   it  shows  a  large  number  of  files  being 
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downloaded  in  an  automated  fashion . 

Q.       And  what  is  the  date  of  the  first  download  of  a 
document  using  WGet? 

A.       That  would  be  March  7,  2010. 

Q.       What  time? 

A.  3:18. 

Q.       And  when  is  the  last  action  of  downloading  using 
WGet  in  the  logs? 

A.       Last  action  is  March  7,  2154. 
Q.  2154? 

A.       I'm  sorry.     7:06.     I  apologize. 

Q.       So  approximately  between  the  first  and  last  action, 
how  much  time  elapsed? 

A.       Just  a  few  hours. 

THE  COURT :     Wait  a  minute .     Let  me  stop  you  there . 
So  the  first  download  is  7  March  of  2010  at  3:18? 

THE  WITNESS:     I  apologize,  ma'am,  7:06. 
THE  COURT :     You  mean  military  time  or  are  you  using 
civilian  time? 
BY  MR.  MORROW: 

Q.       Agent  Shaver,   let's  just  go  through  it. 
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Permission  to  publish  to  the  court,   Your  Honor.  I'm 
just  going  to  show  the  first  page  of  this  exhibit,  Your 
Honor . 

Agent  Shaver,   approximately  how  much  time,   based  on 
your  review  of  these  logs,  how  much  time  elapses  between  each 
use  of  WGet? 

A.       Not  a  lot,   sir.     If  you  can  see  from  lines  seven 
through  13,   they're  all  7:46.     Excuse  me.     3:46.     So  not  a 
lot  of  time  between  each  one . 

Q.       And  let's,   if  you  could  just  look  at  those  lines 
specifically  and  just  move  to  the  right  there,   can  you 
describe  the  action  at  the  very  right  of  the  screen?  What 
does  the  200  mean  and  then  describe  going  right,  what  does 
that  mean? 

A.       Yes,   sir.     Starting  200.     200  means  success.  The 
number  following  is  the  size  of  the  file .     And  a  little 
further  to  the  right  it  shows  what  was  used.     In  this  case  it 
was  WGet  and  that  was  the  version,  1.11.4. 

Q.       Now,   if  you  go  to  the  left  a  little  bit,   I  see  a 
number  of  lines  sort  of  recreated,   document  ID  equals  144708, 
and  then  a  number  of  document  ID .     What  is  the  document  ID? 
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A.       The  server  this  is  being  captured  from  is  a 
Sharepoint  server  pertaining  to  Guantanamo  Bay  detainees .  As 
such  the  documents  are  not  stored  by  a  common  name,  they're 
stored  by  a  document  ID.     So  to  retrieve  it,   if  you  were  to 
go  to  the  website,  you  would  click  on  the  link  that  said 
common  name,  need  a  person's  last  name.     But  actually 
underneath  it  in  the  code  it  would  say  to  retrieve  a  certain 
document  ID . 

Q.       So  in  this  case  what  does  the  document  ID  represent? 
A.       A  file  name. 

Q.       Agent  Shaver,   approximately  how  many  WGet  actions 
did  you  observe  in  this  log  on  7  March? 
A.       Over  700. 

MR.  MORROW:     Your  Honor,   at  this  time  the 
prosecution  moves  to  admit  prosecution  exhibit  83  for 
identification  into  evidence  as  prosecution  exhibit  83 . 

MR.   TOOMAN:     No  objection,   Your  Honor. 

THE  COURT:     Can  I  see  it,  please? 

Thank  you .     Prosecution  exhibit  83  for 
identification  is  admitted. 
BY  MR.  MORROW: 
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Q.       Agent  Shaver,   you  said  that  those  document  IDs 
resolved  or  went  back  to  the  detainee  assessments  located  on 
the  SIPRNET,  correct? 

A.  Correct. 

Q.       Now,   in  any  time  in  your  review  of  the  Intelink 
logs,   did  you  notice  any  other  activity  or  accessing  of 
information  on  detainee  records  on  Intelink? 

A.       Yes,  sir. 

Q.       And  what  time  was  that? 
A.       5  March  2010. 

Q.       I'm  retrieving  what's  been  marked  as  prosecution 
exhibit  82  for  identification . 

I'm  handing  the  witness  what's  been  marked  as 
prosecution  exhibit  82  for  identification. 

Do  you  recognize  that  document,  Agent  Shaver? 
A.       Yes,   sir,   I  do. 
Q.       And  what  is  that? 

A.       Sir,   this  is  a  document,   a  subset  of  the  Intelink 
for  March  5,  2010. 

MR.  MORROW:     Permission  to  publish  to  the  court, 
Your  Honor . 
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THE  COURT:  Proceed. 
BY  MR.  MORROW: 

Q.       Agent  Shaver,   I'm  just  going  to  show  you  the  first 
page  of  the  exhibit.     And  if  you  would,  Agent  Shaver,  using 
this  document,   just  describe  the  activity  that  you're  seeing 
in  the  logs . 

A.       The  activity,   somebody  is  on  a  computer  assigned  IP 
dot  22  is  downloading  files.     Again,   you  see  the  file 
document  again  and  you  see  their  link  to  the  website  is  there 
and  you  see  some  200s  and  you  see  some  000s.     There's  an 
issue  for  that  download  didn't  quite  work  right.     And  there's 
time  and  dates  associated  with  those  downloads . 

Q.       Now,   in  terms  of  what  the  user  is  doing  or  what 
you ' re  observing  in  this  activity  on  the  Intelink  versus  the 
7  March  activity,  what's  the  difference  between  those  two 
accessing  —  the  accessing  of  the  detainee  assessment  on 
those  two  dates? 

A.       This  appears  to  be  a  lot  of  right  clicking,   save  as. 

Q.       And  why  do  you  say  that? 

A.       Because  it's  the  time.     It's  not  as  fast  and  there's 
some  errors ,   so  it  looks ,   it  appears  to  be  somebody ' s 
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manually  downloading  these  files . 

Q.       Did  you  observe  WGet  on  5  March? 
A.       No,  sir. 

Q.       And  how  do  you  know  that,   again,  these  are  detainee 
assessments,  where  are  the  logs  that  show  those  are  the  files 
being  accessed? 

A.       It  actually  says  that,  action  line,   it  says  the 
website  week  JDIV  Gitmo  detainee  assessments . 

Q.       Thank  you.     Now,   again  — 

THE  COURT:     Before  you  move  that,   I've  got  a 
question.     You  have  the  200s  where  you  say  were  a  success, 
after  some  of  the  200s  then  you  have  000.     What  does  that 
mean? 

THE  WITNESS:     There's  a  problem. 
THE  COURT:     Thank  you. 
BY  MR.  MORROW: 

Q.       Agent  Shaver,   how  was  this,   again,   and  you  may  have 
answered  this,  how  was  this  summary  created? 

A.       I  filtered  based  off  the  date  and  the  action. 
MR.  MORROW:     Your  Honor,   at  this  time  the 
prosecution  moves  to  admit  prosecution  exhibit  82  for 
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identification  into  evidence . 

MR.   TOOMAN:     No  objection,   Your  Honor. 

THE  COURT:     Prosecution  exhibit  82  is  admitted. 

MR.  MORROW:     Thank  you,  Agent  Shaver.  Government 
has  no  further  questions  at  this  time . 

MR.   TOOMAN:     Your  Honor,   the  defense  would  request  a 
ten  minute  comfort  break . 

THE  COURT:     Any  objection? 

MR.  FEIN:     No,  ma'am. 

THE  COURT:     All  right.     Agent  Shaver,   please  don't 
discuss  your  testimony  or  knowledge  of  the  case  with  anyone 
other  than  counsel  or  the  accused  while  we  are  on  the  recess . 
Court  is  in  recess  until  five  minutes  to  eleven . 
(BRIEF  RECESS . ) 

THE  COURT:     Court  is  called  to  order.     Let  the 
record  reflect  all  parties  present  when  the  court . 
Captain  Tooman,   cross  examination. 
MR.   TOOMAN:     Thank  you,   Your  Honor. 

CROSS  EXAMINATION 

BY  MR.  TOOMAN: 

Q.       Good  morning,  Agent  Shaver. 
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A.       Good  morning,  sir. 

Q.       Agent  Shaver,   I'd  like  to  start  out  by  on  direct  you 
talked  a  little  bit  about  some  of  the  computers  that  you  had 
associated  with  my  client. 

A.       Yes,  sir. 

Q.       You  had  associated  the  dot  22  machine? 
A.       Yes,  sir. 

Q.       That  was  one.     And  the  other  was  the  dot  40  machine? 
A.       Yes,  sir. 

Q.       I  want  to  focus  on  the  dot  22  machine  for  just  a 
moment.     Now,   on  that  machine,   you  didn't  have  any  activity 
that  you  would  associate  with  my  client  before  2  March  in  the 
allocated  space,   is  that  correct? 

A .       Okay . 

THE  COURT:     Whoa,   whoa,  whoa. 

Q.       On  the  dot  22  machine  there  was  a  user  account, 
Bradley  dot  Manning,  correct? 

A .       Right . 

Q .       And  that  user  account  didn ' t  have  anything  in  the 
unallocated  space  before  2  March,   is  that  correct? 

MR.  MORROW:     Objection.     Outside  the  scope  of 
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direct . 

THE  COURT:  Overruled. 

THE  WITNESS:     Sir,   your  terminology  I  believe  is 
incorrect . 
BY  MR.  TOOMAN: 
Q .       Okay . 

A.  You're  asking  —  may  I  ask?  You're  asking  me  are 
there  any  files  pertaining  to  the  Bradley  dot  Manning  user 
account  prior  to  2  March? 

Q.       2  March. 

A.       That  are  allocated. 

Q.       That  are  unallocated.     Let  me  rephrase  the  question. 
In  the  dot  22  computer,  there's  a  user  account, 
Bradley  Manning? 
A.  Correct. 

Q.       That  user  account  didn't  exist  before  2  March, 
correct? 

A.  Correct. 

Q.       And  that  user  account  didn't  exist  before  2  March 
because  that  computer  had  been  re-imaged? 
A.  Correct. 
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Q .       And  that  computer  was  re-imaged  by  the  G6  or  whoever 
was  in  charge  of  those  computers? 
A.       That's  correct. 

Q .       Okay .     And  you ' ve  been  to  Iraq? 
A.       Yes,  sir. 

Q.       And  you  understand  that  there  are  a  lot  of  reasons 
why  a  computer  would  be  re-imaged  in  Iraq? 
A.  Correct. 

Q.       It ' s  a  difficult  environment  for  the  machine? 
A.       Yes,  sir. 

Q.       It's  hot,   that  puts  stress  on  the  machine?  It's 
dusty,  sandy? 

A.       Yes,  sir. 

Q.       And  those  things  could  cause  problems  for  the 
machine? 

A.  Correct. 

Q.       And  one  way  that  an  administrator  might  deal  with 
those  problems  is  to  re-image  it? 
A.  Correct. 

Q.       That's  what  happened  with  the  dot  22  machine? 
A.  Correct. 
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Q.       And  that  wasn't  anything  my  client  did,   that  was 
whoever  was  in  charge  of  those  machines? 
A.       Yes,  sir. 

Q.       Now,  you  talked  about,  on  direct  you  talked  about 
the  Intelink  logs  and  the  searches,  you  talked  about  how  you 
created  the  Excel  document  where  you  were  able  to  pull  out 
all  of  the  actual  searches? 

A.       Yes,  sir. 

Q.       And  to  separate  the  wheat  from  the  chaff,  here  are 
the  searches,  correct? 
A .       Uh-huh . 

Q.       And  you  talked  about  a  number  of  searches  for 
WikiLeaks? 

A.       Yes,  sir. 

Q.       You  talked  about  searches  for  ACIC  documents? 
A.       Just  WikiLeaks. 

Q.       Well,  you  talked  about  searches  or  activity  on  the 
Intelink  logs  related  to  detainee  assessments? 
A.  Correct. 

Q.       There  were  in  total  from  May  —  I'm  sorry.  From 
November  of  2009  to  May  of  2010  there  were  probably  close  to 
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800  searches? 

A .       Sounds  right . 

Q.       And  not  all  of  those  had  to  do  with  WikiLeaks? 
A.  Correct. 

Q.       A  lot  of  those  searches  had  to  do  with  a  lot  of 
other  things? 

A.       Yes,  sir. 

Q.  And  with  those  Intelink  logs,  all  you  can  really  say 
is  that  the  dot  22  machine  or  the  dot  40  machine  did  a  search 
for  whatever  term? 

A.  Correct. 

Q .       You  can ' t  say  that  that  was  PFC  Manning  who  did  the 
search? 

A.  Correct. 

Q .       You  can ' t  say  it  was  Captain  Tooman  who  did  the 
search? 

A.  Correct. 

Q.       You  could  say  if  it  was  you  that  did  the  search,  but 
you  don ' t  know  who  did  the  search? 
A.  Correct. 

Q.       Okay.     There  were  a  lot  of  other  searches  done? 
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A.       Yes,  sir. 

Q.       There  were  searches  for  gender  identity  disorder? 
A.       Yes,  sir. 

Q.       There  were  searches  for  APFT  scores? 
A.       Yes,  sir. 

Q.       There  were  searches  for  Green  to  Gold? 
A.       Yes,  sir. 

Q.       Now,   I  want  to  focus  on  some  more  of  those  searches. 
There  were  also  a  number  of  searches  related  to  CENTCOM, 
correct? 

A.  Correct. 

Q.       Now,   CENTCOM  is  the  command  that  oversees  Iraq, 
correct? 

A.       Yes,  sir. 

Q.       Iraq  falls  underneath  CENTCOM.     So  there  would  be  a 
lot  of  reasons  why  a  computer  user  might  search  for  CENTCOM? 
A.  Sure. 

Q.       I  want  to  talk  about  some  of  those  CENTCOM  searches 
a  little  more  specifically.     There  was  a  search  for  CENTCOM 
on  or  involving  CENTCOM  on  30  November  2009,   is  that  correct? 

A .       Sounds  right . 
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Q .       There  was  another  search  on  9  December  for  CENTCOM 
that  was  done  by  the  40  machine? 
A .       Okay . 

Q.       Is  that  —  do  you  have  you  — 

A.       I  don't  have  the  notes  in  front  of  me,  sir. 

THE  COURT:     Let  me  ask  you  to  do  something,  please. 
If  you  know  something  to  be  a  fact  and  you're  agreeing  with 
the  questioner,   say  that.     If  you  don't  know  or  you're  not 
sure  because  you  don't  have  something  in  front  of  you,  don't 
agree . 

THE  WITNESS:  Okay. 
BY  MR.  TOOMAN: 

Q.       Is  there  anything  that  would  allow  you  to  answer 
those  questions? 

A.       Yes,   sir.     One  of  the  exhibits  from  earlier. 

MR.   TOOMAN:     Okay.     Your  Honor,   I'd  like  to  retrieve 
prosecution  exhibit  81  and  ask  Agent  Shaver  to  move  to  the 
witness  stand  because  I  believe  that's  classified. 
THE  COURT:     All  right.  Certainly. 

MR.   TOOMAN:     Handing  the  witness  what's  been  marked 
as  prosecution  exhibit  81. 
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BY  MR.  TOOMAN: 

Q.       Agent  Shaver,   we'll  start  over.     We'll  start  from 
the  top  with  searches  that  implicate  CENTCOM.     On  the  30th  of 
November  we  have  a  search  by  the  dot  40  machine  related  to 
CENTCOM,   is  that  correct? 

A.         (INAUDIBLE) . 

Q .       No ,   I  do  not . 

A.         (INAUDIBLE) . 

THE  COURT :     Take  your  time . 
THE  WITNESS:     Yes,  sir. 

Q.       There's  also  a  search  on  9  December  by  the  dot  40 
machine  and  that ' s  a  search  for  S  J  A  plus  CENTCOM? 

A.       Yes,  sir. 

Q.  And  on  the  15th  of  November  —  I'm  sorry  —  the  15th 
of  December,  again,  the  dot  40  machine,  we  have  a  search  just 
for  CENTCOM? 

THE  COURT:     Did  you  say  the  14th  of  December? 
MR.   TOOMAN:     15th,   Your  Honor. 
THE  WITNESS:     Correct.     Yes,  sir. 
BY  MR.  TOOMAN: 

Q.       The  very  next  day,   again,   the  dot  40  machine 
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searched  for  CENTCOM  plus  S  J  A? 
A.       Yes,  sir. 

Q.       Then  on  the  31st  of  December  the  dot  40  machine 
searched  for  CENTCOM  plus  portal? 
A.  Correct. 

Q.       2  January  2010  we  see  the  40  machine  searching  for 
CENTCOM  plus  non-rel,   N  O  N  R  E  L? 
A.       Yes,  sir. 

Q.       On  the  4th  the  dot  40  machine  searches  for  CENTCOM? 
A.       Yes,  sir. 

Q.       Okay.     Then  our  next  search  is  the  19th  of  February, 
still  the  dot  40  machine  and  it's  just  for  CENTCOM? 


A. 

What  date  again  was  that,  sir? 

Q. 

19  February. 

A. 

Yes,  sir. 

Q. 

And  then  on  the  28th? 

A. 

Yes,  sir. 

Q. 

We  have  one  by  the  dot  40  machine  as  well? 

A. 

Yes,  sir. 

Q. 

And  that ' s  a  search  for  CENTCOM? 

A. 

On  28  November,  yes,  sir. 
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Q.       Then  on  12  March,   we  see  our  first  search  from  the 
dot  22  machine,   and  that's  for  a  long  string,  but  you  would 
agree  with  me  that  that  is  basically  searching  for  don't  ask, 
don't  tell? 

A.       Yes,  sir. 

Q.       Then  on  the  17th  of  March,   the  22  machine  searches 
for,   again,   another  long  string  E-Books  plus  site,  percentage 
three? 

A.       Yes,   sir,   I  see  that. 

Q.       And  then  on  the  22nd  of  March  we  see  a  search  for 
Farah  plus  CENTCOM,   and  that  was  the  22  machine? 
A.       Yes,  sir. 

Q.       Let  me  retrieve  that  exhibit  from  you.  Handing 
prosecution  exhibit  81  back  to  the  court  reporter. 

Now,  Agent  Shaver,   those  were  the  only  searches  for 
CENTCOM  on  the  Intelink  logs  that  specifically  talked  about 
CENTCOM,  correct? 

A.       Looks  that  way,  yes,  sir. 

Q.       And  there  was  only  one  that  specifically  searched 
for  Farah? 

A.  Correct. 
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Q.       And  that  was  on  22  March? 
A.  Yes. 

Q.       Agent  Shaver,   I  want  to  talk  a  little  bit  more  about 
Farah.     You  talked  on  direct  about  there  are  ways  that  we  can 
tell,  you  can  tell  a  search  was  done,  but  we  can't  really 
tell  what  happened  after  that,   is  that  correct? 

A .       That ' s  correct . 

Q.       There's  some  indication  that  maybe  a  file  was 
viewed,  but  we  have  to  look  other  places  to  find  out  what 
happened  as  a  result  of  that  search,  correct? 

A.  Correct. 

Q.       And  one  of  those  places  would  be  Centaur  logs,  is 
that  correct? 
A.  Yes. 

Q.       Could  you  explain  to  the  court  what  a  Centaur  log 

is? 

A.       Yes,  sir. 

MR.  MORROW:     Your  Honor,   objection.     There's  been  no 
evidence  to  suggest  that  he  examined  something  called  a 
Centaur  log.     Lack  of  foundation  here.     It's  outside  the 
scope  of  direct  examination. 
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THE  COURT:     How  is  it  within  the  scope? 

MR.   TOOMAN:     It's  within  the  scope  of  direct 
examination,  Your  Honor,  because  the  government  talked  about 
searches  and  then  different  ways  that  we  can  see  what 
happened  with  the  searches . 

Additionally,   the  government  has  already  requested 
judicial  notice  of  the  Centaur  logs  so  that ' s  already 
something  the  court  has  considered.     This  witness  has 
reviewed  the  Centaur  logs,  he  will  talk  about  that. 

THE  COURT:     I'm  going  to  overrule  at  this  point  just 
telling  me  what  a  Centaur  log  is .     Do  you  dispute  the  fact 
that  he  does  know  what  it  is? 

MR.  MORROW:     No,   Your  Honor.     I  do  dispute  the  fact 
that  we  asked  you  to  take  judicial  notice  of  the  Centaur  logs 
though . 

THE  COURT :     Do  you  have  your  consolidated  judicial 
notice  list  has  that  been  put  on  as  an  appellate  exhibit  yet? 

MR.   TOOMAN:     Your  Honor,   it's  in  the  18  July  2012 
ruling,   appellate  exhibit  216. 

THE  COURT:     May  I  see  appellate  exhibit  216,  please? 

216  is  the  one  you're  relying  on,  right? 
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MR.   TOOMAN:     Yes,  ma'am. 

THE  COURT:     All  right.     Government,   I'm  looking  at 
appellate  exhibit  216.     Number  four  talks  about  Centaur  logs. 

MR.  FEIN:     Yes,  ma'am.     So  this  was  a  government 
motion  to  preadmit  evidence,   not  judicial  notice.  The 
government  did  move  to  preadmit  and  the  court  ruled  that 
based  off  the  government ' s  showing  of  relevance  that  this 
evidence  would  otherwise  be  admissible.     The  government  does 
intend  to  admit  this  evidence,   in  fact,  with  the  predicate 
witnesses  prior  to  Special  Agent  Shaver  and  then  Special 
Agent  Shaver's  testimony.     I  think  my  co-counsel's  objection 
was  just  based  off  it's  outside  the  scope  of  this  direct 
because  there's  no  context,  no  foundation,  prior  facts  not 
going  to  understand  that  the  background  is  Centaur . 

THE  COURT :     So  you ' re  going  to  be  recalling  this 
witness  to  talk  about  Centaur  logs? 

MR.  FEIN:     Absolutely,   Your  Honor. 

THE  COURT:     Why  are  we  getting  into  it  now? 

MR.   TOOMAN:     Your  Honor,   the  government  believes  the 
government  opened  the  door  to  Agent  Shaver ' s  investigation 
and  we ' d  like  to  talk  to  him  about  it . 
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THE  COURT:     The  government  didn't  mention  anything 
about  Centaur  logs,   so  are  you  waiving  your  relevance 
objection  for  these  logs  to  come  in? 

MR.   TOOMAN:     Yes,   Your  Honor.     We  would,   yes,  Your 

Honor . 

THE  COURT :     I  think  it ' s  beyond  the  scope  of  direct . 
The  government  just  didn't  talk  about  it,   so  I'm  going  to 
sustain  the  objection. 

MR.   TOOMAN:  Okay. 
BY  MR.  TOOMAN: 

Q.       Agent  Shaver,   I'd  like  to  talk  to  you,   you  spoke  on 
direct  about  the  ACIC  report? 
A.       Yes,  sir. 

Q.       And  you  saw  a  number  of  searches  for  that,   one  was 
on  29  December,   there  was  one  on  14  February? 
A.  Correct. 

Q.       And  then  there  were  two  on  1  March,  correct? 

Your  testimony  on  direct  was  only  one  of  those 
searches  was  successful  and  that  only  one  time  did  something 
get  pulled  up? 

A.       No,  sir. 
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Q .       Okay . 

A.       I  can  show,   number  one,   the  first  hit  was  a  success. 
The  other  ones  are  redirected.     I  don't  know  if  they're 
successful.     They're  redirected  to  another  log  file,  another 
server.     I  cannot  tell  you  if  it  was  successful  or  it  was 
not . 

Q.       Okay.     So  only  that  first  search  could  you  say  for 
sure  this  was  successful? 
A.  Correct. 

Q.       Now,  based  on  your  review  of  the  intel  logs,  you 
couldn't  say  if  that  document  was  downloaded,  correct? 

A.       It  was  viewed,   so  technically  it  was  downloaded 
because  you  see  the  bytes  transferred.     It  was  viewed  upon 
the  computer  itself. 

Q.       Okay.     You  couldn't  tell  if  there  was  a  right  click, 
save  as? 

A.       No,  sir. 

Q.       You  couldn't  tell  if  it  was  printed? 
A.       No,  sir. 

Q.       You  also  couldn't  tell  how  long  that  screen  was  up, 
correct? 
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A.  Correct. 

Q.       So  it  could  have  been  up  for  a  second,   it  could  have 
been  up  for  five  minutes? 
A.  Correct. 

Q.       The  same  would  be  true  for  the  C3  report  that  you 
talked  about  on  direct  as  well,  correct? 
A.  Correct. 

Q.       Can't  tell  how  long  it  was  viewed,   is  that  correct? 
A.  Correct. 

Q.       You  can't  tell  if  it  was  saved? 
A.  Correct. 

Q.       You  also  couldn't  tell  if  it  was  printed? 
A .       That ' s  correct . 

Q.  And  I  believe  you  said  that  the  22  machine  is  the 
one  that  did  those  things.  Either  way  you  can't  associate 
the  viewing  of  those  documents  with  any  particular  person, 
correct? 

A.  Correct. 

Q .       Just  with  the  machine . 
A.  Correct. 

Q.       I'd  like  to  speak  with  you,  you  talked  about  WGet  on 
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direct .     I'd  like  to  talk  to  you  now  about  that . 

You  would  agree  with  me  that  WGet  is  a  program 
that's  used  to  download  web  pages? 

A.       Yes,  sir. 

Q.       Archive  pages? 

A.  Sure. 

Q.       Download  things? 
A.  Sure. 

Q.       You  wouldn't  say  that  this  is  a  program  that's 
synonymous  with  hacking,  would  you? 
A.       Correct.     It's  just  a  tool. 

Q .       Just  a  normal  program  that ' s  used  every  day  by  a  lot 
of  different  people? 
A.       Yes,  sir. 

Q.       Now,  you  talked  about  detainee  assessment  briefs? 
A.       Yes,  sir. 

Q .       And  you  talked  about  the  Intelink ' s  logs  show  that 
on  5  March  there  were  attempts  from  your  perspective  of 
clicking,   opening  and  saving,   that's  what  the  Intelink  log 
suggested? 

A.  Correct. 
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Q.       And  then  on  7  March  you  had,   again,   activity  with 
the  detainee  assessment  briefs,  but  here  it  looked  like  WGet 
was  used  to  download  those  files,  correct? 

A.       Yes,  sir. 

Q.       You  would  agree  with  me  that  basically  what  WGet  was 
doing  was  clicking,   opening  and  saving,   it  was  just  doing  it 
quickly? 

A.       In  automated  fashion. 

Q.       Faster  than  a  human  could  do  it? 

A.  Yes. 

Q.       But  still  the  same  action,  essentially  the  click, 
open,  save? 

A.  Correct. 

Q.       Now,   as  part  of  your  investigation,  you  actually 
used  WGet,   didn't  you? 

A.       Yes,   sir,   I  did. 

Q.       And  what  you  did  with  WGet  was  you  tried  to 
download,  you  wanted  to  see  if  you  could  download  the 
detainee  assessment  briefs? 

A.  Correct. 

Q.       And  you  were  able  to  do  that? 
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A.  Correct. 

Q.       And  what  you  did  was  you  wrote  a  script  and  you  ran 
the  script  and  then  you  actually  downloaded  the  detainee 
assessment  briefs? 

A.       Yes,  sir. 

Q.       And  that  only  took  you  a  few  minutes  to  do? 
A.       Yes,   sir.     Did  not  take  very  long. 

Q.       Didn't  take  very  long  to  download  over  700  detainee 
assessment  briefs? 
A.  Correct. 

Q.       And  while  that  was  happening,   you  were  able  to  do 
other  things  on  your  machine? 
A.       Yes,  sir. 

Q.       So  one  could  run  WGet  and  it  would  run  in  the 
background  and  you  could  do  other  things? 

A.       Yes,   sir.     You  would  take  a  performance  hit,  but, 

yes . 

Q.       When  WGet ' s  running,   you  don't  have  to  actually  be 
there,   do  you?    You  don't  have  to  be  sitting  at  the  computer 
actively  doing  anything,  correct? 

A.       No,  sir. 


Provided  by  Freedom  of  the  Press  Foundation 


1 

2 
3 
4 
5 
6 
7 
8 
9 
10 
11 
12 
13 
14 
15 
16 
17 
18 
19 
20 
21 


UNOFFICIAL  DRAFT  -  6/10/13  Morning  Session 

78 

Q.       And,   again,   it  basically  just  automates  the  click, 
open,  save? 

A.  Correct. 

MR.   TOOMAN:     No  further  questions,   Your  Honor. 

THE  COURT:     All  right.  Redirect. 

MR.  MORROW:     No,   Your  Honor. 

THE  COURT :     All  right .     I  have  a  couple . 

We  talked  earlier  about  the  200  means  it's 
successful  and  the  000  means  there's  a  problem. 

You  just  said  in  response  to  Captain  Tooman's 
questions  that  when  a  search  is  redirected  to  somewhere  else, 
you  don't  know  what  happens  to  it.     Can  you  just  tell  me, 
give  me  an  example  of  a  search,  you  would  search  for 
something  and  it  would  go  somewhere  else  and  what  happens? 

THE  WITNESS:     Yes,  ma'am.     So  are  you  familiar  with 

Google? 

THE  COURT:  Yes. 

THE  WITNESS :     So  you  go  to  Google  and  you  put  in 
Wolf  Blitzer,   it  takes  you  to  the  CNN  web  page  and  now  you're 
on  the  CNN  web  page .     Google  is  no  longer  tracking  what 
you're  doing  on  CNN,  but  the  redirect  took  you  there.     And  in 
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this  instance  that  R  B  document  was  directed  to  another  site, 
and  once  it ' s  on  the  other  site  it ' s  no  longer  part  of 
Intelink.     Does  that  make  sense? 

THE  COURT:     Yes.     Thank  you. 

You  testified  earlier  that  to  assess  whether  a 
program  is  authorized  on  a  Army  computer,   I  just  want  to  make 
sure  I  got  your  testimony  correctly.     What  did  you  use  the 
Army  Gold  Master's  program  to  determine? 

THE  WITNESS :     We  used  that  —  excuse  me .     When  I 
worked  at  CCIU,  we  would  use  that  to  determine  what  are  the 
authorized  programs,   those  are  the  Army  programs  that  are 
commonly  available  to  the  users  on  the  Army  network .  WGet 
was  never  part  of  those . 

THE  COURT:     If  you're  not  the  right  witness  to  ask 
this  question  to,   tell  me. 

Are  you  familiar  with,  does  that  program  say  that  if 
it's  not  on  here,  you  can't  use  it  or  you  can't  put  it  on  the 
computer? 

THE  WITNESS:     No,  ma'am.     That  would  be  considered  a 
certificate  of  networthiness,   also  called  a  CON.     That  would 
be  the  final  authority  on  what ' s  authorized  and  what ' s 
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unauthorized . 

THE  COURT:     I'm  beginning  to  stray  into  areas  that 
the  government  mentioned  on  their  direct,  but  were  not  fully 
explored.     Any  objection  to  my  continuing  to  question  this 
witness  about  them? 

MR.  MORROW:     No,   Your  Honor. 

MR.   TOOMAN:     No,  ma'am. 

THE  COURT:     Tell  me  what  that  was  called  again,  a 
certificate  of  — 

THE  WITNESS:     Networthiness .     Commonly  referred  to 
as  a  CON,  CON. 

THE  COURT:     Assume  I'm  a  computer  user,   how  do  I  go 
about  obtaining  a  CON? 

THE  WITNESS:     It  is  a  process  through  one  of  the 
Army  SERS,   the  Army  regional  at  Fort  Huachuca,  Arizona.  You 
would  put  in  a  request  to  use  a  piece  of  software  on  the  Army 
network .     They  would  evaluate  it  to  make  sure  it ' s  not  —  it 
meets  certain  criteria,  whether  you  have  to  pay  for  it,  what 
it  does  on  the  network,   does  it  create  a  vulnerability  on  the 
network .     And  then  they  would  eventually  get  back  to  you  and 
say  yes  or  no. 
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THE  COURT :     The  Army  sometimes  structures  automation 
such  that  the  user  does  not  have  administrative  rights  to 
insert,  to  add  things  in  the  computers  that  you  examined  that 
you  testified  about  today.     Could  the  user,   did  the  user  have 
administrative  rights  to  add  whatever  they  wanted  to? 

THE  WITNESS:     No,  ma'am,   they  do  not.     However,  WGet 
is  the,  the  executable  itself  does  not  need  administrative 
privileges  to  run,   so  you  can  use,   anybody  can  download  it, 
anybody  can  run  it . 

THE  COURT :     Are  you  aware  of  any  specific 
authorization  of  or  prohibition  of  program  WGet? 

THE  WITNESS:     When  I  looked  at  the  certificate  of 
networthiness,   WGet  was  not  on  that  list. 

THE  COURT:     So  that  certificate  is  one  certificate 

of  — 

THE  WITNESS:     The  CON  itself,   the  one  I  saw  the 
Excel  spreadsheet  of  what  was  authorized  and  what  was  not 
authorized  for  the  Army  network .     I  was  looking  at  it  for 
another  matter .     I  obtained  it  for  another  case .     But  WGet 
was  not  present  on  that  CON. 

THE  COURT:     And  that  CON  was  applicable  for  what,  a 
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particular  unit  or  geographic  area? 

THE  WITNESS:     As  far  as  I  know,   the  Army. 
THE  COURT :     Any  follow-up  questions  from  either  side 
based  on  my  questions? 

MR.  MORROW:     One  moment,   Your  Honor. 

Just  a  couple  of  questions,   Your  Honor. 
REDIRECT  EXAMINATION 

BY  MR.  MORROW: 

Q.       Agent  Shaver,   when  someone  searches  for  something  on 
the  SIPRNET,   and  we've  probably  have  gone  over  this,   but  what 
does  the  resulting,   at  least  if  you're  on  the  Intelink 
server,  what  does  the  resulting  activity  show  in  the  logs? 

A.       It  would  show  any  hits  pertinent  to  the  search  you 
put  in . 

Q.       Now,  when  you  say  hits,  what  do  you  mean  by  that? 

A.       Again,   it's  basically  Google,   so  if  you  put  a 
keyword  in,   again,   let's  go  back  to  Wolf  Blitzer,  everything 
that  pops  up  would  be  pertinent  to  the  key  term  Wolf  Blitzer. 

Q.       So  you  would  have  a  number  of  results? 

A.       Yes,  sir. 

Q.       And  if  you  clicked  on  one  of  those  results,  what 
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would  happen? 

A.       It  would  take  you  to  the  website  or  the  document 
pertaining  to  that  information . 

Q.       Now,   if  it  took  you  to  the  website  or  document 
pertaining  to  that  information,  would  that  activity  always  be 
captured  by  the  Intelink  logs? 

A.       No,  sir. 

Q.       And  why  is  that? 

A.       Depends,   sir.     Depends  where  the  document  is 
located.     Again,   if  it's  not  on  —  if  it's  on  another  website 
it  would  be  captured,  that  information  would  be  captured  on 
that  other  website . 

Q.       Agent  Shaver,   when  you  were  talking  about  the 
certificate  of  networthiness,  what  type  of  computer  were  you 
referring  to? 

A.       Windows  computer. 

Q.       But  SIPRNET,  NIPRNET,   what  were  you  talking  about? 
A.       Either  or. 

Q.       Have  you  seen  the  certificate  of  networthiness  for  a 
DCGS  Alpha  computer? 

A.       No,   sir,   I  have  not. 
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Q.  And  where  does  WGet  come  from,  where  does  someone 
acquire  or  obtain  the  WGet  program? 

A.  You  would  find  it,  you  would  search  for  it  on  the 
Internet  and  find  it  on  the  Internet . 

Q.       So  it ' s  available  to  anyone  on  the  Internet? 

A .       That ' s  correct . 

Q.       And  if  you  were  to  put  a  program  or  an  executable 
like  WGet  on  a  computer,  and  you  wanted  it  to  be  available  to 
all  the  users  of  that  computer,  anyone  who  logged  in,  where 
would  you  put  it  on  the  computer? 

A.       Program  files. 

Q.       And  why  would  you  put  it  in  the  program  files  if  you 
wanted  it  to  be  available  to  all  the  users? 

A.       It ' s  a  permission  issue.     Everybody  can  have  access 
to  it .     They  can  all  execute  that  document .     If  for  example 
you  put  it  in  a  user  profile,   one  user  profile  just  due  to 
permissions  cannot  see  the  contents  of  another  user  for 
security  reasons . 

Q.       So  a  computer  may  have  any  number  of  user  profiles 
because,  at  least  in  the  government,  people  share  computers, 
right? 
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MR.  MORROW:     Thank  you. 

MR.   TOOMAN:     Just  a  couple,   Your  Honor. 
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RECROSS  EXAMINATION 

BY  MR.  TOOMAN: 

Q .       Agent  Shaver . 
A.  Sir. 

Q.       You  spoke  about  the  Army  Gold  Master's  program.  The 
Army  Gold  Master  program,   they  don't  review  every  program  or 
software  executable  file  that  exists,  correct? 

A.       The  Army  Gold  Master  is  just  a  disk  of  software  they 
provide,   the  Army  provides  to  the  users. 

Q.       Well,  the  Army  doesn't  review  every  single  file  or 
piece  of  software  type  of  executable  file  to  determine 
whether  or  not  there's  a  certificate  of  networthiness  for  it, 
correct?     Did  it  look  at  everything? 

A.       Everything  in  the  world? 

Q.       Everything  in  the  world. 

A.  No. 

Q.       So  the  fact  that  there  isn't  a  certificate  of 
networthiness  doesn't  necessarily  mean  that  it  would  be  a 
problem  to  have  it  on  the  Army  system? 

A.       Technically  as  I  understand  it,  technically  you 
would  need  an  exception  to  policy,  the  Army,  you  would  just 
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have  an  exception  of  policy  to  run  a  specific  program  on  a 
specific  network  for  a  specific  reason .     There  would  be  a 
signed  document  for  that . 

Q.  And  I  guess  a  certificate  of  networthiness  or  the 
lack  of  a  certificate  of  networthiness  doesn't  mean  if  the 
program  were  reviewed  it  wouldn't  get  one? 

A.  Correct. 

Q.       Now,  you  talked  about  WGet .     WGet  is  an  executable 
file,   is  that  correct? 
A .       That ' s  correct . 

Q.       And  you  double  click  on  it,   it  opens,   and  it  runs, 
correct? 

A.  Again,  it's  a  command  line,  so  if  you  double  click 
on  it,  a  black  window  would  open  and  close  very  quickly  and 
not  do  anything.     You  have  to  do  it  from  the  command  line. 

Q .       You  would  agree  with  me  that  it ' s  an  executable 
file? 

A.       Yes,  sir. 

Q.       And  Army  systems  can  be  configured  to  prevent  the 
running  of  executable  files? 
A.  Yes. 
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Q.       Now,  you  talked  about  where  an  individual  can  put  a 
file  if  they  add  something  to  their  machine .     They  could  put 
it  in  their  own  personal  user  file  or  it  could  get  added  to 
program  files,  correct? 

A.  Correct. 

Q.       If  you  wanted  to  add  something  to  the  program  files, 
I  would  need  administrative  rights  for  that,  wouldn't  I? 
A .       That ' s  correct . 

MR.   TOOMAN:     Nothing  further,   Your  Honor.  Thank 

you . 

THE  COURT:     Any  redirect  from  the  government? 
MR.  MORROW:     No,   Your  Honor. 

THE  COURT:     Let  me  just  make  sure  I'm  clear  on  this. 
Based  on  the  last  question  from  Captain  Tooman,   am  I 
understanding  this  WGet  program  was  in  the  user  files  as 
opposed  to  the  programs  file  on  the  computers  you  found? 

THE  WITNESS:  Correct. 

THE  COURT:     If  the  user  attempted  to  put  WGet  on  the 
programs  file,  what  would  have  happened? 

THE  WITNESS:     They  would  ask  for  permission.  They 
would  ask  for  administrator  privilege  or  account  to  do  this . 
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THE  COURT:     Well,   did  the  user  in  this  case  have  an 
administrative  privilege  account? 
THE  WITNESS:  No. 

THE  COURT:     If  the  user  tried  to  put  that  program  on 
a  program  drive  without  going  through  that  process  that  you 
just  described,  would  the  computer  let  him? 

THE  WITNESS:  No. 

THE  COURT :     Any  further  questions  based  on  my  — 
MR.  MORROW:     No,   Your  Honor. 
MR.   TOOMAN:     No,  ma'am. 

THE  COURT:     All  right.     Temporary  excusal? 
MR.  MORROW:     Temporary,   Your  Honor. 

THE  COURT:     Special  Agent  Shaver,   once  again,  you're 
temporarily  excused.     Please  don't  discuss  your  testimony 
with  anyone  but  the  accused  or  the  counsel  while  the  trial  is 
going  on. 

MR.  WHYTE:     Ma'am,   the  United  States  calls  Mr.  Chad 

Madaras . 
Whereupon : 

CHAD  MADARAS, 

called  as  a  witness,  having  been  first  duly  sworn  according 
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to  law,  testified  as  follows : 

DIRECT  EXAMINATION 

BY  MR.  WHYTE: 

Q.       You  are  Chad  Madaras? 
A.       Yes,  sir. 

Q.       Mr.  Madaras,  what  is  your  current  military  status? 

A.       I'm  inactive  reserves,  sir. 

Q.       When  did  you  leave  the  military? 

A.       January  16,  2013. 

Q.       And  how  long  did  you  serve  for? 

A.       Approximately  six  years,  sir. 

Q.       What  was  your  MOS  during  that  time? 

A.       I  was  a  35  Fox  intel  analyst. 

Q.       For  the  entire  six  years? 

A.       Yes,  sir. 

Q.       And  where  were  you  stationed? 
A.       At  Fort  Drum. 

Q.       Do  you  remember  when  you  arrived  at  Fort  Drum? 
A.       November  2007. 

Q.       When  you  arrived  what  unit  were  you  assigned  to? 
A.       Second  Brigade,  sir. 
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Q.       Tenth  Mountain  Division? 
A.       Yes,  sir. 

Q.       And  how  did  you  know  PFC  Manning  at  Fort  Drum? 
A.       I  didn't  really  know  him  that  well  at  Fort  Drum,  I 
just  met  him  once  in  the  smoking  area  outside  our  barracks . 
Q.       Did  you  deploy  out  of  Fort  Drum? 
A.       Yes,  sir. 

Q.       And  what  pre-deployment? 

A.       I  had  two  JRTC  rotations  and  a  DCGS  course. 

Q.       The  JRTC,   when  were  those? 

A.       October  of  2008  and  July  of  2009,  sir. 

Q.       Did  PFC  Manning  attend  both  of  those  with  you? 

A.       From  the  best  of  my  recollection,  yes,  sir. 

Q.       And  you  mentioned  a  DCGS  training,   can  you  explain 
what  that  entailed? 

A.       We  had  a  DCGS  course  that  covered  all  the 
fundamentals  of  a  DCGS  machine  multi-function  station  and  how 
to  use  all  the  components. 

Q.       Did  PFC  Manning  attend  that  with  you? 

A.       Yes,   he  did. 

Q.       At  this  training  what  were  you  taught  about  who  was 
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responsible  for  handling  the  DCGS  machine  in  theater? 

A.  We  were  told  we  have  a  DCGS  FSR  downrange  with  us. 

Q.  And  what  is  an  FSR? 

A.  Field  support  representative,  sir. 

Q.  How  long  is  this  training  on  the  DCGS  machine? 

A.  It  was  a  week  long,  sir. 

Q.  So  where  did  you  deploy  from? 

A.  Second  Brigade,   Fort  Drum. 

Q.  Where  did  you  deploy  to? 

A.  FOB  Hammer,  sir. 

Q.  Did  PFC  Manning  deploy  to  FOB  Hammer  as  well? 

A.  Yes,  sir. 

Q.  Do  you  remember  when  you  arrived  at  FOB  Hammer? 

A.  Sometime  around  October  15,  2009. 

Q.  Do  your  remember  when  PFC  Manning  arrived? 

A.  It  would  be  about  a  week  or  two  later,  sir. 

Q.  Where  did  you  work  at  FOB  Hammer? 

A.  In  the  brigade  SCIF . 

Q.  Where  did  PFC  Manning  work? 

A.  In  the  brigade  SCIF  also. 

Q.  And  what  section  were  you  assigned  to? 
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A 

Q 
A 

Q 

A 

Q 

A 

Q 

A 

Q 

A 

Q 

A 

Q 


We  were  fusion  cell,  part  of  the  Shia  team. 

What  do  you  mean  by  we? 

Me  and  PFC  Manning. 

So  you  both  were  Shia  — 

Yes,  sir. 

—  intel  analysts  working  in  the  SCIF? 
Yes,  sir. 

What  shift  did  you  work  on? 
I  worked  day  shift . 

And  what  shift  did  Manning  work  on? 
The  night  shift . 

What  type  of  computer  did  you  use  at  FOB  Hammer? 
We  used  DCGS-A  laptop,  Dell. 

And  how  many  computers  did  you  have  at  your  work 


station  in  the  SCIF? 


A 

Q 
A 

Q 
A 

Q 


Just  one,  sir. 

And  who  did  you  share  that  work  station  with? 
I  shared  it  with  PFC  Manning. 

What  network  was  this  DCGS  machine  hooked  up  to? 
It  was  on  the  SIPRNET  work,  sir. 

And  who  did  you  share  this  DCGS  SIPRNET  computer? 
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A.       With  PFC  Manning. 

Q.       For  how  long  did  you  share  this? 
A.       For  six  months. 

Q.       When  in  the  deployment  did  you  share  this? 

A.       When  we  first  took  over  all  the  way  up  until  around 
the  March  timeframe,  sir. 

Q.  So  let's  just  talk  about  when  you  were  actually  in 
the  SCIF,  just  to  give  the  court  a  time  line.  You  said  you 
arrived  15  October  2009? 

A.       Yes,  sir. 

Q.       When  was  the  first  time  that  you  left  the  SCIF? 

A.       Just  before  Christmas  of  2009. 

Q.       And  where  did  you  go? 

A.        I  went  to    (INAUDIBLE) . 

Q.       And  how  long  was  this? 

A.       It  was  about  a  week  long. 

Q.       And  then  you  returned  back  to  FOB  Hammer  working  in 
the  SCIF? 

A.       Yes,  sir. 

Q.       When  did  you  next  leave  FOB  Hammer? 

A.       I  left  around  January  27,   28  when  I  went  on  R  and  R. 
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Q.       And  how  long  were  you  gone  for? 
A.       Returned  around  February  15. 

Q.       What  about  the  next  time  you  left  FOB  Hammer? 
A.       I  left  in  March  for  the  parliamentary  elections  of 
Iraq. 

Q.       And  how  long  were  you  gone  for? 
A.       For  a  week  again,  sir. 

Q.       So  when  did  you  stop  working  in  the  SCIF? 

A.       Around  the  end  of  May,  beginning  of  June,  sir. 

Q.       Are  you  familiar  with  Intelink? 

A.       Yes,  sir. 

Q.       What  is  Intelink? 

A.       It's  a  separate  search  engine  like  Google. 
Q.       Did  you  use  Intelink  as  a  35  Fox? 
A.       Yes,  sir. 

Q.       What  are  some  of  the  benefits  of  using  Intelink  as  a 
35  Fox? 

A.       If  you  didn't  have  a  lot  of  information  on  somebody 
or  a  name  came  up  in  a  report  that  you  weren't  really  sure, 
you  can  just  throw  it  in  there  to  see  if  you  got  any  hits 
right  off  the  bat . 
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Q.       Let  the  record  reflect  that  I'm  retrieving 
prosecution  exhibit  81  from  the  court  reporter . 

MR.   COOMBS:     Your  Honor,   to  the  extent  that  the 
government  is  going  to  use  81  to  ask  this  witness  did  he  do 
any  of  those  searches,  we  would  stipulate  that  he  did  not  do 
any  of  those  searches . 

THE  COURT:     All  right.     Is  that  where  you  were  going 
with  this? 

MR.  WHYTE:     Yes,   Your  Honor.     But  it  may  be  helpful 
to  hear  what  Madaras  did  not  search. 

MR.  FEIN:     May  we  have  a  moment,   Your  Honor? 
THE  COURT:     Why?  Okay. 
(DISCUSSION  OFF  THE  RECORD.) 

THE  COURT:     Why  would  it  be  beneficial?     If  the 
defense  is  stipulating  that  the  witness  did  not  do  any  of 
those  searches,  why  would  it  be  beneficial  for  me  to  listen 
to  the  particular  searches  that  he  did  not  do? 

MR.  WHYTE:     Yes,  ma'am.     Never  mind,  we  will  not 

ask . 

THE  COURT:  Proceed. 
BY  MR.  WHYTE: 
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Q.       Mr.  Madaras,   did  you  use  a  CIDNE  Iraq  to  pull 
intelligence? 

A.       Yes,  sir. 

Q.       Are  you  aware  if  there's  a  CIDNE  Afghanistan? 
A.       There  is,  sir. 

Q.       Did  you  use  CIDNE  Afghanistan? 
A.       No,  sir. 
Q.       Why  not? 

A.       It  did  not  really  pertain  to  anything  we  were  doing 
in  our  area. 

Q.       Did  you  use  Net-Centric  diplomacy  to  search  for  any 
intelligence? 

A.       No,  sir. 

Q.       Did  you  pull  any  Department  of  State  cables? 
A.       No,  sir. 

Q.       What  region  of  the  world  were  you  focused  on  when 
you  were  at  FOB  Hammer? 
A.       Eastern  Baghdad. 

Q.       Did  you  ever  search  for  intelligence  on  Iceland? 

A.       No,  sir. 

Q.       South  America? 
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A. 

No,  sir. 

Q. 

Europe? 

A. 

No,  sir. 

Q. 

Africa? 

A. 

No,  sir. 

Q. 

East  Asia? 

A. 

No. 

Q. 

And  why  not? 

A. 

Did  not  pertain  to  anything  we  were  doing  in  eastern 

Baghdad . 

Q.       Are  you  familiar  with  WGet? 
A.       No,  sir. 

Q.       Let's  talk  about  some  of  the  issues  that  you  had 
with  your  computer  when  you  were  at  FOB  Hammer .     During  your 
deployment  explain  what  type  of  problems  you  had  with  the 
computer  at  FOB  Hammer? 

A.       The  computer  used  to  crash  on  a  regular  basis  or 
operate  really,   really  slowly  to  the  point  where  it  was 
difficult  to  get  any  work  done. 

Q.       And  how  often  did  you  have  these  computer  problems? 

A.       About  twice  a  week. 
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Q.       So  can  you  please  explain  to  the  court  during  those 
two  times  per  week  you  showed  up  for  a  shift  change,  what 
happened? 

A.       When  I'd  log  on  to  the  computer,   it  would  run  really 
slow,   wouldn't  really  load  up  anything  that  I  was  trying  to 
use  to  complete  my  work,  and  then  sometimes  it  would  just 
completely  crash. 

Q.       And  when  did  you  notice  these  computer  problems? 

A.       It  was  right  off  the  bat  at  the  beginning  of  my 
shift . 

Q.       So  what  would  you  do  when  you  had  these  computer 
problems? 

A.       I'd  get  Alan  Millman  and  get  him  to  work  on  the 
machine . 

Q .       And  who  was  Mr .  Millman? 
A.       He  was  our  DCGS  FSR. 

Q.       What  would  Mr.  Millman  do  to  fix  the  machines? 
A.       He'd  usually  have  to  re-image  the  system. 
Q.       After  Mr.  Millman  worked  on  the  computer,   can  you 
describe  how  the  computer  operated? 

A.       It  would  operate  like  brand  new  again. 
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How  did  it  operate  for  the  remainder  of  your  shift? 


A.       It  would  operate  well. 
Q.       What  about  the  following  day? 
A.       It  would  slowly  start  to  deteriorate. 
Q.       How  many  times  did  Mr.  Millman  re-image  your 
computer? 

A.       Probably  about  five  times,  sir. 

Q.       And  what  was  your  understanding  of  why  you  were 
having  these  computer  problems? 

MR.   COOMBS:     Objection,   Your  Honor.     Calls  for 

hearsay . 

THE  COURT:     Did  this  witness  get  his  understanding 
from  somebody  else? 

MR.  WHYTE:     Yes,   Your  Honor. 

THE  COURT :     What ' s  the  hearsay  exception? 

MR.  WHYTE:     It's  actually  not  for  the  truth  of  the 
matter  asserted.     It's  effect  on  the  listener,  what  Mr. 
Madaras  did  in  response  to  that . 

THE  COURT:     And  the  question  was  again? 

MR.  WHYTE:     The  question  was  what  was  your 
understanding  as  to  why  you  were  having  these  computer 
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problems . 

THE  COURT:     Why  don't  you  just  ask  him  after  you 
understood  why  you  were  having  the  computer  problems  what  did 
you  do  next? 
BY  MR.  WHYTE: 

Q.       After  you  knew  why  you  were  having  these  computer 
problems,  what  did  you  do  next? 

A.       I  asked  PFC  Manning  to  try  to  remove  some  of  the 
unneeded  documents  off  his  desktop,  and  I  also  did  so  myself. 

Q.       Did  you  look  at  PFC  Manning's  desktop? 

A.       I  couldn't  see  the  desktop,  but  I  could  see  the  file 
size . 

Q.       And  how  would  you  describe  the  file  size? 
A.       It  was  very  large. 

Q.       What  did  you  store  on  your  desktop? 

A.       I  would  store  any  project  that  I  was  currently 
working  on,   so  Power  Points  and  any  reports  that  I  needed  to 
work  on  the  project . 

Q.       So  what  did  you  do  to  reduce  your  desktop  size? 

A.       Anything  that  was  from  previous  project  I  was 
working  on  I  went  ahead  and  deleted  them,   got  rid  of  them. 


Provided  by  Freedom  of  the  Press  Foundation 


1 

2 
3 
4 
5 
6 
7 
8 
9 
10 
11 
12 
13 
14 
15 
16 
17 
18 
19 
20 
21 


UNOFFICIAL  DRAFT  -  6/10/13  Morning  Session 

102 

Q .       So  after  you  told  PFC  Manning  to  limit  the  amount  on 
his  desktop,  did  you  have  problems  after  that? 
A.       Yes,   I  still  did. 

Q.       How  did  your  computer  problems  affect  your  ability 
to  work  at  FOB  Hammer? 

A.       It  would  take  about  two  hours  of  my  work  schedule 
for  Alan  to  figure  out  what  was  wrong  with  it,   and  if  he  had 
to  re-image  it  it  would  take  approximately  two  hours . 

Q.       And  how  often  did  other  35  Foxes  have  problems  with 
their  computers? 

A.       Everybody  had  one  about  once  throughout  their  entire 
deployment . 

Q.       Do  you  remember  when  you  stopped  sharing  a  computer 
with  PFC  Manning? 

A.       It  was  when  I  returned  from  the  elections  in  March 
of  2010. 

MR.  WHYTE:     No  further  questions,   Your  Honor. 
THE  COURT:  Proceed. 

CROSS  EXAMINATION 

BY  MR.  COOMBS: 

Q.       Mr.  Madaras,   you  first  met  PFC  Manning  in  2008? 
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A.       Yes,  sir. 

Q.       And  this  was  out  in  the  smoking  area  outside  the 
barracks  at  Fort  Drum? 
A.       Correct,  sir. 

Q.       Based  upon  those  times  that  you  spoke  with  PFC 
Manning,   you  recall  him  being  interested  in  U.S.  politics? 
A.       Yes,  sir. 

Q.       And  the  way  he  talked,  you  got  the  impression  that 
he  was  interested  in  going  into  politics? 
A.       Not  that  I  can  remember,  sir. 

Q.       Do  you  recall  telling  me  that  based  upon  the  way  he 
talked  you  got  the  impression  that  he  was  interested  in  going 
into  politics? 

A.       Yes,  sir. 

Q.       And  during  those  times  that  you  spoke  with  him,  he 
never  said  anything  that  gave  you  the  impression  that  — 
MR.  FEIN:     Objection,   Your  Honor.  Hearsay. 
THE  COURT:  Yes. 

MR.   COOMBS:     I'm  not  asking  for  a  response.     If  I 
could  finish  my  question,   and  then  I  think  the  objection  may 
be  appropriate  to  — 
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THE  COURT:     What  is  the  question? 

MR .   COOMBS :     —  make  it  at  that  point . 

During  the  times  you  spoke  with  him,   he  never  gave 
you  the  impression  that  he  held  any  anti-American  positions . 

THE  COURT:     I'll  allow  that.     Go  ahead. 

THE  WITNESS:     No,  sir. 
BY  MR.  COOMBS: 

Q.       Now,   you  and  PFC  Manning  both  went  to  JRTC  in  2009? 
A.       Yes,  sir. 

Q.       And  JRTC  was  the  training  that  you  received  in 
preparation  for  deployment  to  Iraq? 
A.       Yes,  sir. 

Q.       And  at  JRTC  the  two  of  you  worked  opposite  shifts? 

A.       Correct,  sir. 

Q.       You  worked  the  night  shift? 

A.       Yes,  sir. 

Q.       And  PFC  Manning  worked  the  day  shift? 
A.       Yes,  sir. 

Q.       And  at  JRTC,   PFC  Manning  was  in  charge  of  working  on 
the  company's  computers  if  there  was  any  problems? 

A.       I  don't  know  if  he  was  in  charge  of  working  on 
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computers,   sir,  but  he  may  have  worked  on  computers,  yes. 

Q.       All  right.     Well,   you  know  he  worked  on  the 
company's  computers  at  JRTC? 

A.       Yes,  sir. 

Q.       He  unlocked  some  of  the  computer  passwords  for  the 
S2  section? 

A.       Not  that  I  remember  at  this  time,   sir.     I  don't 
know. 

Q .       Do  you  recall  telling  me  that  he  unlocked  — 
A.       I  don't  remember. 

Q.       Let  me  finish  my  question.     Do  you  recall  telling  me 
that  he  unlocked  some  of  the  computer  passwords  at  the  S2 
section? 

A.       I  do  not  remember  that,  sir. 

Q.       When  you  say  you  don't  remember,  are  you  saying  I 
don't  remember  now  because  my  memory  is  failing,   or  I  don't 
remember  because  I  don ' t  think  I  ever  said  that  to  you? 

A.       I  don't  remember  it  because  memory  is  failing  from 
that  long  ago,  sir. 

Q.       Okay.     Now,   the  times  in  which  he  was  working  on  the 
computers,   did  anyone  to  your  memory  go  in  and  say,  stop, 
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you're  not  permitted  to  do  that? 
A.       No,  sir. 

Q.       And  he  was  very  good  at  working  on  the  computers, 
correct? 

A.       Yes,  sir. 

Q.       And  what  type  of  computers  did  you  work  off  as  an 
analyst  at  JRTC? 

A.       DCGS-A  computers. 

Q.       Now,   in  Iraq  you  also  had  DCGS-A  computers,  correct? 
A.       Yes,  sir. 

Q.       And  you're  not  really  a  computer  guy,   is  that  right? 
A.  Correct. 

Q.       You  don't  know  much  about  computers  beyond  basically 
the  basic  operating  system? 
A.       Correct,  sir. 

Q.       But  you  knew  that  PFC  Manning  would  occasionally 
work  on  the  DCGS-A  computers  in  Iraq? 
A.       Possibly,  sir. 

Q.       Possibly  meaning  what?     I'm  sorry. 

A.       It's  possible  that  he  did.     I  don't  remember. 

Q.       And  I'm  sorry  to  pin  you  down.     Are  you  saying  you 
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don't  remember  because  so  much  time  has  gone  by,  or  are  you 
saying  you  don ' t  remember  because  you  don ' t  believe  he  ever 
worked  on  the  DCGS  computers? 

A.       So  much  time  has  gone  by. 

Q.       You  don't  recall  that? 

A.       I  don't  recall,  yes. 

Q.       Do  you  recall  telling  me  that  on  the  phone? 
A.  No. 

Q.       Do  you  recall  telling  me  that  you  saw  him  go  into 
the  operating  system  and  try  to  make  the  computer  run  faster? 
A.       No,  sir. 

Q.       You  don't  recall  telling  me  that? 
A.       No,  sir. 

Q.       We  talked  a  little  over  now  about  two  and  a  half 
weeks  ago.     You  don't  recall  telling  me  that  at  that  point? 
A.       I  didn't  talk  to  you  about  two  and  a  half  weeks  ago, 

sir . 

Q.       When's  the  last  time  you  recall? 
A.       It  was  probably  about  two  years  ago  before  the 
Article  32  hearing  was  the  last  time  I  recall  talking  to  you . 
Q.       That's  the  last  time  you  recall  talking  to  me? 
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A.       Yes,  sir. 

Q.       Okay.     Do  you  recall  telling  me  that  you  witnessed 
him  go  into  the  task  manager  and  change  what  programs  are 
running  and  how  they  started? 

A.       I'm  not  sure,  sir. 

Q.       Not  sure  meaning  you  don't  recall  that? 
A.       I  don't  recall,  sir. 

Q.       Okay.     Do  you  recall  telling  me  that  you  witnessed 
him  help  others  with  their  DCGS-A  computers? 
A.       Yes,  sir. 

Q.  All  right.  And  we'll  talk  about  that  in  a  moment, 
but  when  he  was  helping  others,  no  one  stepped  in  and  said, 
hey,  you  can't  do  that,  that's  not  permitted? 

A.       Correct,  sir. 

Q.       Now,   you  said  your  computer  would  crash 
occasionally? 

A.       Yes,  sir. 

Q.       And  sometimes  I  imagine  when  it  crashed  you  lost 
information? 

A.       Yes,  sir. 

Q.       So  would  you  agree  with  me  that  analysts  were 
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encouraged  to  save  information  on  the  T  drive? 
A.       Yes,  sir. 

Q.       And  the  T  drive  was  the  shared  drive  that  everyone 
had  access  to? 

A.       Yes,  sir. 

Q.       And  analysts  were  also  encouraged  if  they  wanted  to 
save  information  on  a  CD? 
A.       Yes,  sir. 

Q.       And,   of  course,  because  it  was  your  computer,  your 
DCGS-A  computer,   you  would  save  information  on  the  desktop  of 
your  computer  were  if  you  wanted? 

A.       Yes,  sir. 

Q.       That  was  permitted? 

A.       Yes,  sir. 

Q.       Now,   I  want  to  talk  about  some  of  the  times  you 
witnessed  others  being  helped  by  PFC  Manning  on  the  DCGS-A 
computer,  okay? 

A.       Yes,  sir. 

Q.       Now,   the  first  time  —  well,   actually  one  of  the 
times  was  dealing  with  mIRC  chat,   is  that  correct? 
A.       Yes,  sir. 
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Q.       And  mIRC  chat  is  one  of  those  baseline  programs  that 
you  didn't  have  on  your  DCGS-A  computer,  right? 
A.       Correct,  sir. 

Q.       But  analysts  needed  mIRC  chat  to  do  their  job? 
A.  Correct. 

Q .       And  that ' s  because  you  as  an  analyst  in  the  S2 
section  would  speak  to  others  who  were  using  mIRC  chat? 
A.  Correct. 

Q .       So  do  you  recall  having  PFC  Manning  set  up  mIRC  chat 
on  your  computer? 
A.       Yes,  sir. 

Q.       And  do  you  recall  him  doing  that  for  others? 
A.       Yes,  sir. 

Q.       And  mIRC  chat,   when  you  did  that,   it  was  put  on  your 
computer  basically  as  something  that  you  would  double  click 
to  start  on  the  desktop? 

A.       Yes,  sir. 

Q.       And  you're  sure  PFC  Manning  did  this  and  not  Mr. 
Millman? 

A.       Yes,  sir. 

Q.       And  when  PFC  Manning  did  this  for  you  and  others, 
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did  anyone  step  in,  to  your  memory,  and  say,  hey,  that's  not 
permitted? 

A.       No,  sir. 

Q.       Now,   at  Fort  Drum  you  attended  DCGS  training  with 
PFC  Manning? 

A.  Correct. 

Q.       And  do  you  recall  who  taught  this  training  to  you? 
A.       I  do  not,  sir. 

Q.       Does  MIT  teams  sound  correct  to  you? 
A.       Yes,   sir,   it  would. 

Q.       And  do  you  recall  what  a  MIT  team  was? 
A.       No,   I  don't. 

Q.       Did  you  ever  receive  any  training  on  what  you  could 
and  could  not  add  on  the  desktop  of  your  DCGS-A  computer? 
A.       Not  that  I  recall. 

Q.       And  just  for  the  judge,   I  want  to  make  sure  it's  not 
that  you  recall,  meaning  I  can't  remember  if  we  did,   or  I 
don ' t  remember  we  ever  did  receive  that  training? 

A.       Yeah.     I  don't  remember,  sir. 

Q.       All  right.     Did  you  ever  receive  any  training 
discussing  what  you  could  and  could  not  place  on  your  desktop 
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like  mIRC  chat,   like  an  executable  file? 
A.       No ,   I  do  not . 

Q.  And,  again,  is  that  you  don't  remember  that,  or  you 
don't  believe  you  received  that  training? 

A.       I  don't  believe  we  received  that  training. 

Q.       Okay.     And  during  the  deployment  did  anyone  say  to 
you  that  you  could  not  put  mIRC  chat  on  your  desktop  as  an 
executable  file? 

A.       No,   they  did  not. 

Q.  Did  you  receive  any  training  either  at  Fort  Drum  or 
during  the  deployment  on  how  you  had  to  download  information 
from  the  SIPRNET? 

A.       Not  that  I  remember,  sir. 

Q.       Was  there  any  formal  guidance  or  statement  to  you 
that  you  had  to  download  information  in  one  particular  way, 
like  click,  open,  save? 

A.  No. 

Q.       Do  you  know  what  exporting  with  Excel  is? 
A.       Yes,  sir. 

Q.       And  could  you  tell  the  judge  what  that  is? 

A.       You'd  take  a  document  and  export  it  into  Excel,  is 
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that  the  one  you ' re  — 
Q.  Yes. 

A.       And  then  it  would  make  a  sheet  for  you  where  it 
would  list  everything  to  like  upload  grid  coordinates  into  an 
ARC  map  or  something,   for  an  example. 

Q.       And  when  you  were  exporting  large  documents,   say  if 
you  were  exporting  a  month  of  SigActs  to  Excel,   did  you  have 
to  click,   open  and  save  every  one  of  the  SigActs  or  would  the 
Excel  export  it  for  you? 

A.       The  Excel  would  export  it  for  us. 

Q.       So  it  would  do  it  in  an  automated  fashion,  correct? 
A.       Yes,  sir. 

Q.       Did  anyone  tell  you  that  that  was  improper,  that 
you're  supposed  to  go  and  click,  open  and  save  and  not  use 
the  automated  process? 

A.  No. 

Q.       And  from  your  memory,   was  that  permitted? 
A.       Yes,  sir. 

Q.       Now,   you  were  a  part  of  the  advance  party  for  Bravo 
company  going  to  Iraq,   is  that  right? 
A.  Correct. 
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Q.       And  if  I'm  correct,   you  departed  Fort  Drum  sometime 
in  October  of  2009? 
A.       Yes,  sir. 

Q.       And  then  you  arrived  at  FOB  Hammer  around  the  15th 
of  October? 

A.       Yes,  sir. 

Q.       And  when  you  arrived,   you  worked  periodically  in  the 
SCIF,   is  that  right? 
A .       Right . 

Q.       You  also  had  to  support  your  company's  operations? 
A.  Correct. 

Q.       So  initially  you  did  not  work  full-time  in  the  SCIF? 
A .       That ' s  correct . 

Q.       And  when  you  were  in  the  SCIF,   you  worked  as  an 
intelligence  analyst? 
A.  Correct. 

Q.       And  I  believe  you  said  you  were  on  the  Shia  threat 
group? 

A.       Yes,  sir. 

Q.       And  obviously  PFC  Manning  was  also  on  that? 
A.  Yes. 
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Q .       And  at  the  start  of  the  deployment  you  worked  the 
day  shift? 

A.  Yes. 

Q.       And  PFC  Manning  worked  the  night  shift? 
A.       Yes,  sir. 

Q.       Now,   on  the  night  shift  PFC  Manning  had  certain 
tasks  that  he  was,   I  guess  had  to  complete,   is  that  correct? 
A.  Correct. 

Q.       And  he  and  the  other  night  shift  analysts  were 
tasked  to  complete  and  update  what  I  believe  was  called  a 
commander's  read  book  each  night,   is  that  right? 

A.       Yes,   that's  correct. 

Q.       And  he  also  had  to  do  a  report  slide  that  was  due 
every  night? 
A.  Yes. 

Q.       And  for  the  slide  PFC  Manning  and  others  had  to  do 
analysis? 

A.  Correct. 

Q.       And  that  slide  was  due  every  night  at  midnight? 
A.       Yes,  sir. 

Q.       And  these  were  products  that  he  was  required  to 
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complete? 

A .       That ' s  correct . 

Q.       Now,   at  any  point  when  you  were  working  in  the 
T-SCIF,   did  they  put  out  any  formal  training  on  the  rules  and 
regulations  of  the  SCIF? 

A.       Not  that  I  recall,  sir. 

Q.       So  when,  and  again,  when  you  say  not  that  you 
recall,  meaning  they  could  have  and  I  don't  remember  it,   or  I 
don't  believe  they  ever  did  that? 

A.       They  could  have  and  I  don't  remember  it. 

Q.       From  your  memory,   did  you  ever  see  soldiers 
listening  to  music  in  the  SCIF? 

A.  Yes. 

Q.       And  where  was  this  music  stored? 

A.       It  was  stored  on  the  T  drive. 

Q.       And  that  was  a  classified  drive,  correct? 

A.  Correct. 

Q.       Did  you  ever  see  the  soldiers  place  that  music  on 
their  DCGS-A  computers? 

A.       I  didn't  see  them  place  it  on  the  DCGS-A  computers, 

no . 
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Q.       Did  you  ever  see  the  soldiers  listening  to  the  music 
on  the  DCGS-A  computers? 
A.       Yes,  sir. 

Q.       Did  you  ever  see  movies  in  the  T-SCIF? 
A.  Yes. 

Q.       And  did  you  ever  see  soldiers  playing  movies  in  the 
T-SCIF? 

A.       Yes,  sir. 

Q.       Did  you  ever  see  video  games  Boeing  played  in  the 
T-SCIF? 

A.       Yes,  sir. 

Q.       And  were  these  being  played  on  the  DCGS-A  computer? 
A.       Yes,  sir. 

Q.       And  to  your  knowledge,  was  anyone  ever  punished  for 
having  movies,  music  or  games  in  the  T-SCIF? 
A.  No. 

Q.       And  we  talked  about  the  fact  that  others  had  had 
mIRC  chat  added  on  to  their  desktop  computer,  right? 
A.  Yes. 

Q.       Was  anyone  ever  punished  for  having  mIRC  chat  put  on 
their  desktop? 
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A.  No. 

Q.       Did  anyone  ever  say  that  that  was  wrong? 
A.  No. 

MR .   COOMBS :     Thank  you . 

THE  COURT:  Redirect? 

MR.  WHYTE:     Yes,  ma'am. 

REDIRECT  EXAMINATION 

BY  MR.  WHYTE: 

Q .       Mr .  Madaras ,   you  said  that  PFC  Manning  helped  other 
soldiers  with  their  DCGS  machines? 
A.  Yes. 

Q.       How  did  he  help  the  other  soldiers? 

A.       From  all  I  can  remember  was  helping  with  mIRC  chat. 

Q.       And  why  was  he  asked  to  help  the  soldiers? 

A.       Because  we  needed  mIRC  chat  so  we  could  talk  to 
other  unit  at  other  FOBs . 

Q .       So  let ' s  talk  about  mIRC  chat .     You  said  you  had  it 
on  your  DCGS  machine? 

A.       Yes,  sir. 

Q.       Where  was  it  located  on  your  machine? 
A.       Right  off  the  desktop. 
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Q.       And  who  else  had  mIRC  chat  on  their  computer? 

A.       Everybody  did,  sir. 

Q.       In  the  S2  shop? 

A.       Yes,  sir. 

Q.       What  about  outside? 

A.       Anybody  that  worked  in  direct  with  us  like  current 
ops  all  had  mIRC  chat . 

Q.       Can  you  explain  to  the  court  what  mIRC  chat  look 
looks  likes  when  you  actually  open  it  up? 

A.       When  you  open  it  up  there's  a  bunch  of  listings  on 
the  left  side  of  the  screen  that  has  all  the  different  chat 
groups  in  it .     In  the  center  it ' s  a  blank  space  so  when  you 
click  to  it  it  opens  it  up  so  you  can  see  that  group,  and  at 
the  bottom  is  where  you  type  in  what  you  want  to  say. 

Q.       And  what  type  of  information  was  communicated  over 
mIRC  chat? 

A.       Mainly  SigActs  that  was  currently  happening  before 
they  were  actually  published  on  the  CPOF . 

Q.       So  why  was  this  information  communicated  on  the  mIRC 
chat? 

A.       Because  the  sooner  we  would  know  about  stuff,  the 
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more  effect  we  could  have  on  the  battle  you  could  say. 

Q.       You  said  that  mIRC  chat  was  stored  on  the  T  drive, 
is  that  correct? 

A.       Yes,  sir. 

Q.       Do  you  know  when  mIRC  chat  was  put  on  the  T  drive? 

A.       I  don't.     It  was  already  on  there  from  the  previous 
unit  when  we  got  in  country. 

Q.       And  then  the  defense  asked  you  about  the  Excel 
export  issue.     Did  CIDNE,   the  program  itself,   allow  you  to 
export  SigActs? 

A.       Yes,   sir,   you  could  then  port  them  directly  into 
Excel . 

Q.       And  also  movies,  music,  games,  that  was  also  asked 
by  the  defense .     Do  you  know  when  that  information  was  put  on 
the  T  drive? 

A.       That  was  on  the  T  drive  from  the  previous  unit. 
MR.  WHYTE:     No  further  questions,   Your  Honor. 
THE  COURT:     Go  ahead. 
MR.   COOMBS:     Just  one  follow-up. 

RECROSS  EXAMINATION 

BY  MR.  COOMBS: 
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Q.       The  DCGS-A  computer,   did  anyone  besides  intelligence 
analysts  have  DCGS  computers? 
A.       I  do  not  know,  sir. 

Q.       Were  DCGS-A  computers  computers  that  were  part  of 
what  you  did  as  intelligence  analysts? 
A.       Yes,  sir. 

Q.       Would  a  person  who  didn't  have  a  job  that  dealt  with 
intelligence  analysts  be  working  off  a  DCGS-A  computer? 
A.       No,  sir. 

MR .   COOMBS :     Thank  you . 

THE  COURT:     Any  last  redirect? 

THE  WITNESS:     No,  ma'am. 

THE  COURT:     Mr.  Madaras,   I  have  a  few  questions. 
The  DCGS-A  computers  that  were  down  range,   you  testified 
earlier  there ' s  a  T  drive  and  that  T  drive  stored  mIRC  chat . 

THE  WITNESS:     Yes,  ma'am. 

THE  COURT:     So  the  T  drive  was  accessible  to  all 
users,  but  were  your  individual  user  drives  or  your  user 
profiles  accessible  to  your  colleagues? 

THE  WITNESS:     If  we  saved  them  on  to  the  T  drive 
they  were,  ma'am. 
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THE  COURT:     So  you  said,   you  testified  PFC  Manning 
helped  you  install  mIRC  chat  on  your  desktop.     Was  that  as  a 
shortcut  from  the  T  drive? 

THE  WITNESS:     That  would  be  as  a  shortcut,  ma'am, 
yes,   from  my  understanding. 

THE  COURT:     Was  there  a  separate  mIRC  chat  on  your 
user  profile  as  well? 

THE  WITNESS:     I  do  not  know. 

THE  COURT:     When  you  used  mIRC  chat,  where  did  you 
use  it  from? 

THE  WITNESS:     Right  off  my  desktop. 

THE  COURT:     You  testified  earlier  that  music,  books 
and  games  were  already  on  the  T  drive  from  the  previous  unit . 
Did  any  of  the  members  of  the  SCIF,   are  you  aware,  did 
anybody  put  new  movies,   games  or  videos  on  the  T  drive? 

THE  WITNESS:     Not  that  I  know  of,  no. 

THE  COURT:     Do  you  know  if  there  was  any 
authorization  or  prohibition  from  —  any  authorizing  to  do 
that,   authorization  to  do  that  or  prohibition  against  doing 
that? 

THE  WITNESS:     No,  ma'am,   I  do  not  know. 
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THE  COURT:     So  there  was  basically  silence  on  the 

issue? 

THE  WITNESS:  Correct. 

THE  COURT:     Who  supervised  you? 

THE  WITNESS:     Kyle  Balonek  did. 

THE  COURT:     Would  Mr.   Balonek  have  been  aware  of 
people  watching  these  movies  and  playing  these  games  on  the  T 
drive . 

THE  WITNESS:     Yes,   I  would  believe  so. 

THE  COURT:     When  you  testified  earlier  that  Mr. 
Millman  I  believe  his  name  was  would  come  and  help  you  fix 
the  computer  problems  that  you  had  when  you  had  them? 

THE  WITNESS:  Yes. 

THE  COURT:     Did  —  and  he  would  re-image  them. 
THE  WITNESS:     Yes,   that's  correct. 

THE  COURT:     When  someone  re-images  a  computer,  what 
happens  to  the  data  that  you  have? 

THE  WITNESS:     From  my  understanding  it  gets  rid  of 
everything  like  starting  fresh. 

THE  COURT :     Were  you  ever  in  a  situation  where  you 
needed  data  from  your  computer  before  it  was  re-imaged? 
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THE  WITNESS:  Yes. 

THE  COURT:     What  did  you  do  with  that  data? 

THE  WITNESS:     We'd  save  it  to  a  CD. 

THE  COURT:     And  what  would  you  do  with  the.  CD? 

THE  WITNESS :     It  would  go  into  the  computer  again 
once  he  was  done  re-imaging  it  and  re-save  all  the  files  to 
the  computer  that  were  needed,  ma'am. 

THE  COURT:     Now,  when  the  computer  is  re-imaged, 
does  it  strip  data  from  the  T  drive,  too? 

THE  WITNESS :     No .     The  T  drive  was  a  completely 
separate  function. 

THE  COURT:     So  the  re-imaging  would  just  be  for  your 
user  profile? 

THE  WITNESS:     Just  for  the  computer,   thinking  that 
was  saved  on  that  computer ' s  hard  drive . 

THE  COURT:     So  the  T  drive  is  a  shared  drive  located 
somewhere  else? 

THE  WITNESS:  Correct. 

THE  COURT:     If  the  computers  would  go  down 
frequently,  why  would  you  not  save  everything  on  the  T  drive? 
THE  WITNESS :     We  usually  tried  to  save  most 
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everything  that  we  were  working  on  on  the  T  drive,  ma'am. 

THE  COURT:     You  testified  earlier  that  you  didn't  do 
any  searches  of  Europe  and  Iceland  and  all  of  the  other  areas 
that  you  talked  about  because  it  wasn't  in  your  particular 
area  of  operations.     What's  your  understanding  of,   say  you 
had  down  time,   instead  of  watching  a  movie,  you  wanted  to  see 
what  was  going  on  in  the  world,   for  example .     What  is  your 
understanding  of  what  the  policy,   if  any,  was  with  respect  to 
you  searching  things  that  didn ' t  have  anything  to  do  with 
your  AO? 

THE  WITNESS :     I  don ' t  believe  there  was  any 
stipulation  against  doing  so. 

THE  COURT:     Any  questions  based  on  my  — 
MR.   COOMBS:     No,   Your  Honor. 
MR.  FEIN:     No,   Your  Honor. 

THE  COURT :     All  right .     Anything  else  for  this 

witness? 

MR.  WHYTE:     No,  ma'am. 

THE  COURT:     All  right.     Please  don't  discuss  your 
testimony  with  anyone  other  than  counsel  and  the  accused 
while  the  trial  is  still  going  on . 
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All  right.     Counsel,   I'm  looking  at  the  time,  I'm 
also  looking  at  stipulations  of  expected  testimony  that  I 
have  here .     Would  this  be  a  good  time  to  go  through  the 
stipulations  of  expected  testimony  with  PFC  Manning  and  then 
break  for  a  lunch,   or  would  you  rather  break  for  lunch  and 
then  go  through  it  afterwards? 

MR.  FEIN:     Ma'am,   the  United  States  recommends  that 
we  break  for  lunch,   for  a  two  hour  lunch  recess  because  we 
have  more  stipulations  and  then  we  can  put  them  all  together 
at  one  time . 

THE  COURT:     Any  objection  to  that? 

MR .   COOMBS :     No ,  ma ' am . 

THE  COURT:     Any.     Court  will  reconvene  at  1400  or 
two  o ' clock . 

(LUNCH  RECESS) 
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